CVE-2024-39301 (GCVE-0-2024-39301)

Vulnerability from cvelistv5 – Published: 2024-06-25 14:22 – Updated: 2026-05-11 20:20
VLAI
Title
net/9p: fix uninit-value in p9_client_rpc()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/9p: fix uninit-value in p9_client_rpc() Syzbot with the help of KMSAN reported the following error: BUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline] BUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 trace_9p_client_res include/trace/events/9p.h:146 [inline] p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410 v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122 legacy_get_tree+0x114/0x290 fs/fs_context.c:662 vfs_get_tree+0xa7/0x570 fs/super.c:1797 do_new_mount+0x71f/0x15e0 fs/namespace.c:3352 path_mount+0x742/0x1f20 fs/namespace.c:3679 do_mount fs/namespace.c:3692 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x725/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2175 [inline] allocate_slab mm/slub.c:2338 [inline] new_slab+0x2de/0x1400 mm/slub.c:2391 ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852 p9_tag_alloc net/9p/client.c:278 [inline] p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641 p9_client_rpc+0x27e/0x1340 net/9p/client.c:688 p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410 v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122 legacy_get_tree+0x114/0x290 fs/fs_context.c:662 vfs_get_tree+0xa7/0x570 fs/super.c:1797 do_new_mount+0x71f/0x15e0 fs/namespace.c:3352 path_mount+0x742/0x1f20 fs/namespace.c:3679 do_mount fs/namespace.c:3692 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x725/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 If p9_check_errors() fails early in p9_client_rpc(), req->rc.tag will not be properly initialized. However, trace_9p_client_res() ends up trying to print it out anyway before p9_client_rpc() finishes. Fix this issue by assigning default values to p9_fcall fields such as 'tag' and (just in case KMSAN unearths something new) 'id' during the tag allocation stage.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < 72c5d8e416ecc46af370a1340b3db5ff0b0cc867 (git)
Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < 2101901dd58c6da4924bc5efb217a1d83436290b (git)
Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < 124947855564572713d705a13be7d0c9dae16a17 (git)
Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < 89969ffbeb948ffc159d19252e7469490103011b (git)
Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < ca71f204711ad24113e8b344dc5bb8b0385f5672 (git)
Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < 6c1791130b781c843572fb6391c4a4c5d857ab17 (git)
Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < fe5c604053c36c62af24eee8a76407d026ea5163 (git)
Affected: 348b59012e5c6402741d067cf6eeeb6271999d06 , < 25460d6f39024cc3b8241b14c7ccf0d6f11a736a (git)
Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 4.19.316 , ≤ 4.19.* (semver)
Unaffected: 5.4.278 , ≤ 5.4.* (semver)
Unaffected: 5.10.219 , ≤ 5.10.* (semver)
Unaffected: 5.15.161 , ≤ 5.15.* (semver)
Unaffected: 6.1.94 , ≤ 6.1.* (semver)
Unaffected: 6.6.34 , ≤ 6.6.* (semver)
Unaffected: 6.9.5 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39301",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-25T15:42:59.168505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-25T15:43:08.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:19:20.748Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/9p/client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72c5d8e416ecc46af370a1340b3db5ff0b0cc867",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            },
            {
              "lessThan": "2101901dd58c6da4924bc5efb217a1d83436290b",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            },
            {
              "lessThan": "124947855564572713d705a13be7d0c9dae16a17",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            },
            {
              "lessThan": "89969ffbeb948ffc159d19252e7469490103011b",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            },
            {
              "lessThan": "ca71f204711ad24113e8b344dc5bb8b0385f5672",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            },
            {
              "lessThan": "6c1791130b781c843572fb6391c4a4c5d857ab17",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            },
            {
              "lessThan": "fe5c604053c36c62af24eee8a76407d026ea5163",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            },
            {
              "lessThan": "25460d6f39024cc3b8241b14c7ccf0d6f11a736a",
              "status": "affected",
              "version": "348b59012e5c6402741d067cf6eeeb6271999d06",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/9p/client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.94",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.34",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: fix uninit-value in p9_client_rpc()\n\nSyzbot with the help of KMSAN reported the following error:\n\nBUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]\nBUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\n trace_9p_client_res include/trace/events/9p.h:146 [inline]\n p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\n path_mount+0x742/0x1f20 fs/namespace.c:3679\n do_mount fs/namespace.c:3692 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nUninit was created at:\n __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598\n __alloc_pages_node include/linux/gfp.h:238 [inline]\n alloc_pages_node include/linux/gfp.h:261 [inline]\n alloc_slab_page mm/slub.c:2175 [inline]\n allocate_slab mm/slub.c:2338 [inline]\n new_slab+0x2de/0x1400 mm/slub.c:2391\n ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525\n __slab_alloc mm/slub.c:3610 [inline]\n __slab_alloc_node mm/slub.c:3663 [inline]\n slab_alloc_node mm/slub.c:3835 [inline]\n kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852\n p9_tag_alloc net/9p/client.c:278 [inline]\n p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641\n p9_client_rpc+0x27e/0x1340 net/9p/client.c:688\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\n path_mount+0x742/0x1f20 fs/namespace.c:3679\n do_mount fs/namespace.c:3692 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nIf p9_check_errors() fails early in p9_client_rpc(), req-\u003erc.tag\nwill not be properly initialized. However, trace_9p_client_res()\nends up trying to print it out anyway before p9_client_rpc()\nfinishes.\n\nFix this issue by assigning default values to p9_fcall fields\nsuch as \u0027tag\u0027 and (just in case KMSAN unearths something new) \u0027id\u0027\nduring the tag allocation stage."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:20:56.953Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867"
        },
        {
          "url": "https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b"
        },
        {
          "url": "https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17"
        },
        {
          "url": "https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163"
        },
        {
          "url": "https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a"
        }
      ],
      "title": "net/9p: fix uninit-value in p9_client_rpc()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39301",
    "datePublished": "2024-06-25T14:22:41.566Z",
    "dateReserved": "2024-06-24T13:53:25.535Z",
    "dateUpdated": "2026-05-11T20:20:56.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-39301",
      "date": "2026-05-27",
      "epss": "0.00028",
      "percentile": "0.08524"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.2\", \"versionEndExcluding\": \"4.19.316\", \"matchCriteriaId\": \"CCF5D1C7-721B-4F6D-A174-0C49C221A367\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.278\", \"matchCriteriaId\": \"7FDBF235-DA18-49A1-8690-6C7272FD0701\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.219\", \"matchCriteriaId\": \"E9063AF3-D593-43B7-810D-58B87F82F9F9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.161\", \"matchCriteriaId\": \"31130639-53FE-4726-8986-434EE2528CB2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.94\", \"matchCriteriaId\": \"9D20DE32-76F8-4E4C-A8DF-5B53082D18E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.34\", \"matchCriteriaId\": \"6BD9DCFD-0342-4039-B8CE-70F26DB7173B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.5\", \"matchCriteriaId\": \"8366481F-770F-4850-9D0F-2977BD97D5C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/9p: fix uninit-value in p9_client_rpc()\\n\\nSyzbot with the help of KMSAN reported the following error:\\n\\nBUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]\\nBUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\\n trace_9p_client_res include/trace/events/9p.h:146 [inline]\\n p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\\n path_mount+0x742/0x1f20 fs/namespace.c:3679\\n do_mount fs/namespace.c:3692 [inline]\\n __do_sys_mount fs/namespace.c:3898 [inline]\\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\\n do_syscall_64+0xd5/0x1f0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nUninit was created at:\\n __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598\\n __alloc_pages_node include/linux/gfp.h:238 [inline]\\n alloc_pages_node include/linux/gfp.h:261 [inline]\\n alloc_slab_page mm/slub.c:2175 [inline]\\n allocate_slab mm/slub.c:2338 [inline]\\n new_slab+0x2de/0x1400 mm/slub.c:2391\\n ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525\\n __slab_alloc mm/slub.c:3610 [inline]\\n __slab_alloc_node mm/slub.c:3663 [inline]\\n slab_alloc_node mm/slub.c:3835 [inline]\\n kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852\\n p9_tag_alloc net/9p/client.c:278 [inline]\\n p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641\\n p9_client_rpc+0x27e/0x1340 net/9p/client.c:688\\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\\n path_mount+0x742/0x1f20 fs/namespace.c:3679\\n do_mount fs/namespace.c:3692 [inline]\\n __do_sys_mount fs/namespace.c:3898 [inline]\\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\\n do_syscall_64+0xd5/0x1f0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nIf p9_check_errors() fails early in p9_client_rpc(), req-\u003erc.tag\\nwill not be properly initialized. However, trace_9p_client_res()\\nends up trying to print it out anyway before p9_client_rpc()\\nfinishes.\\n\\nFix this issue by assigning default values to p9_fcall fields\\nsuch as \u0027tag\u0027 and (just in case KMSAN unearths something new) \u0027id\u0027\\nduring the tag allocation stage.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: net/9p: corrige el valor uninit en p9_client_rpc() Syzbot con la ayuda de KMSAN inform\\u00f3 el siguiente error: ERROR: KMSAN: valor uninit en trace_9p_client_res include/trace/events/ 9p.h:146 [en l\\u00ednea] ERROR: KMSAN: valor uninit en p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 trace_9p_client_res include/trace/events/9p.h:146 [en l\\u00ednea] p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410 v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c: 122 Legacy_get_tree+0x114/0x290 fs/fs_context.c:662 vfs_get_tree+0xa7/0x570 fs/super.c:1797 do_new_mount+0x71f/0x15e0 fs/namespace.c:3352 path_mount+0x742/0x1f20 fs/namespace.c:3679 montar fs/namespace.c:3692 [en l\\u00ednea] __do_sys_mount fs/namespace.c:3898 [en l\\u00ednea] __se_sys_mount+0x725/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875 do_syscall_64+0xd5/ 0x1f0 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit se cre\\u00f3 en: __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598 __alloc_pages_node include/linux/gfp.h:238 [en l\\u00ednea] alloc_pages_node include/linux/gfp.h:261 [en l\\u00ednea] p\\u00e1gina mm /slub.c:2175 [en l\\u00ednea] allocate_slab mm/slub.c:2338 [en l\\u00ednea] new_slab+0x2de/0x1400 mm/slub.c:2391 ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525 __slab_alloc mm/slub.c :3610 [en l\\u00ednea] __slab_alloc_node mm/slub.c:3663 [en l\\u00ednea] slab_alloc_node mm/slub.c:3835 [en l\\u00ednea] kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852 p9_tag_alloc net/9p/client.c:278 [ en l\\u00ednea] p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641 p9_client_rpc+0x27e/0x1340 net/9p/client.c:688 p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 1b9/0x28e0fs /9p/v9fs.c:410 v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122 Legacy_get_tree+0x114/0x290 fs/fs_context.c:662 vfs_get_tree+0xa7/0x570 fs/super.c:1797 do_new_mount+0x71f/ 0x15e0 fs/namespace.c:3352 path_mount+0x742/0x1f20 fs/namespace.c:3679 do_mount fs/namespace.c:3692 [en l\\u00ednea] __do_sys_mount fs/namespace.c:3898 [en l\\u00ednea] __se_sys_mount+0x725/0x810 fs/namespace .c: 3875 __x64_sys_mount+0xe4/0x150 fs/namespace.c: 3875 do_syscall_64+0xd5/0x1f0 entry_syscall_64_after_hwframe+0x6d/0x75 if p9_check_errors () fails en p9_client no se inicialice correctamente. Sin embargo, trace_9p_client_res() termina intentando imprimirlo de todos modos antes de que finalice p9_client_rpc(). Solucione este problema asignando valores predeterminados a los campos p9_fcall como \u0027etiqueta\u0027 y (en caso de que KMSAN descubra algo nuevo) \u0027id\u0027 durante la etapa de asignaci\\u00f3n de etiquetas.\"}]",
      "id": "CVE-2024-39301",
      "lastModified": "2024-11-21T09:27:25.003",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-06-25T15:15:14.240",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-665\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39301\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-25T15:15:14.240\",\"lastModified\":\"2024-11-21T09:27:25.003\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/9p: fix uninit-value in p9_client_rpc()\\n\\nSyzbot with the help of KMSAN reported the following error:\\n\\nBUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]\\nBUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\\n trace_9p_client_res include/trace/events/9p.h:146 [inline]\\n p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\\n path_mount+0x742/0x1f20 fs/namespace.c:3679\\n do_mount fs/namespace.c:3692 [inline]\\n __do_sys_mount fs/namespace.c:3898 [inline]\\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\\n do_syscall_64+0xd5/0x1f0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nUninit was created at:\\n __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598\\n __alloc_pages_node include/linux/gfp.h:238 [inline]\\n alloc_pages_node include/linux/gfp.h:261 [inline]\\n alloc_slab_page mm/slub.c:2175 [inline]\\n allocate_slab mm/slub.c:2338 [inline]\\n new_slab+0x2de/0x1400 mm/slub.c:2391\\n ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525\\n __slab_alloc mm/slub.c:3610 [inline]\\n __slab_alloc_node mm/slub.c:3663 [inline]\\n slab_alloc_node mm/slub.c:3835 [inline]\\n kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852\\n p9_tag_alloc net/9p/client.c:278 [inline]\\n p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641\\n p9_client_rpc+0x27e/0x1340 net/9p/client.c:688\\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\\n path_mount+0x742/0x1f20 fs/namespace.c:3679\\n do_mount fs/namespace.c:3692 [inline]\\n __do_sys_mount fs/namespace.c:3898 [inline]\\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\\n do_syscall_64+0xd5/0x1f0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nIf p9_check_errors() fails early in p9_client_rpc(), req-\u003erc.tag\\nwill not be properly initialized. However, trace_9p_client_res()\\nends up trying to print it out anyway before p9_client_rpc()\\nfinishes.\\n\\nFix this issue by assigning default values to p9_fcall fields\\nsuch as \u0027tag\u0027 and (just in case KMSAN unearths something new) \u0027id\u0027\\nduring the tag allocation stage.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/9p: corrige el valor uninit en p9_client_rpc() Syzbot con la ayuda de KMSAN inform\u00f3 el siguiente error: ERROR: KMSAN: valor uninit en trace_9p_client_res include/trace/events/ 9p.h:146 [en l\u00ednea] ERROR: KMSAN: valor uninit en p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 trace_9p_client_res include/trace/events/9p.h:146 [en l\u00ednea] p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410 v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c: 122 Legacy_get_tree+0x114/0x290 fs/fs_context.c:662 vfs_get_tree+0xa7/0x570 fs/super.c:1797 do_new_mount+0x71f/0x15e0 fs/namespace.c:3352 path_mount+0x742/0x1f20 fs/namespace.c:3679 montar fs/namespace.c:3692 [en l\u00ednea] __do_sys_mount fs/namespace.c:3898 [en l\u00ednea] __se_sys_mount+0x725/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875 do_syscall_64+0xd5/ 0x1f0 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit se cre\u00f3 en: __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598 __alloc_pages_node include/linux/gfp.h:238 [en l\u00ednea] alloc_pages_node include/linux/gfp.h:261 [en l\u00ednea] p\u00e1gina mm /slub.c:2175 [en l\u00ednea] allocate_slab mm/slub.c:2338 [en l\u00ednea] new_slab+0x2de/0x1400 mm/slub.c:2391 ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525 __slab_alloc mm/slub.c :3610 [en l\u00ednea] __slab_alloc_node mm/slub.c:3663 [en l\u00ednea] slab_alloc_node mm/slub.c:3835 [en l\u00ednea] kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852 p9_tag_alloc net/9p/client.c:278 [ en l\u00ednea] p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641 p9_client_rpc+0x27e/0x1340 net/9p/client.c:688 p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 1b9/0x28e0fs /9p/v9fs.c:410 v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122 Legacy_get_tree+0x114/0x290 fs/fs_context.c:662 vfs_get_tree+0xa7/0x570 fs/super.c:1797 do_new_mount+0x71f/ 0x15e0 fs/namespace.c:3352 path_mount+0x742/0x1f20 fs/namespace.c:3679 do_mount fs/namespace.c:3692 [en l\u00ednea] __do_sys_mount fs/namespace.c:3898 [en l\u00ednea] __se_sys_mount+0x725/0x810 fs/namespace .c: 3875 __x64_sys_mount+0xe4/0x150 fs/namespace.c: 3875 do_syscall_64+0xd5/0x1f0 entry_syscall_64_after_hwframe+0x6d/0x75 if p9_check_errors () fails en p9_client no se inicialice correctamente. Sin embargo, trace_9p_client_res() termina intentando imprimirlo de todos modos antes de que finalice p9_client_rpc(). Solucione este problema asignando valores predeterminados a los campos p9_fcall como \u0027etiqueta\u0027 y (en caso de que KMSAN descubra algo nuevo) \u0027id\u0027 durante la etapa de asignaci\u00f3n de etiquetas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-665\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2\",\"versionEndExcluding\":\"4.19.316\",\"matchCriteriaId\":\"CCF5D1C7-721B-4F6D-A174-0C49C221A367\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.278\",\"matchCriteriaId\":\"7FDBF235-DA18-49A1-8690-6C7272FD0701\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.219\",\"matchCriteriaId\":\"E9063AF3-D593-43B7-810D-58B87F82F9F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"31130639-53FE-4726-8986-434EE2528CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.94\",\"matchCriteriaId\":\"9D20DE32-76F8-4E4C-A8DF-5B53082D18E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.34\",\"matchCriteriaId\":\"6BD9DCFD-0342-4039-B8CE-70F26DB7173B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.5\",\"matchCriteriaId\":\"8366481F-770F-4850-9D0F-2977BD97D5C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:19:20.748Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39301\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-25T15:42:59.168505Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-25T15:43:05.104Z\"}}], \"cna\": {\"title\": \"net/9p: fix uninit-value in p9_client_rpc()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"72c5d8e416ecc46af370a1340b3db5ff0b0cc867\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"2101901dd58c6da4924bc5efb217a1d83436290b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"124947855564572713d705a13be7d0c9dae16a17\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"89969ffbeb948ffc159d19252e7469490103011b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"ca71f204711ad24113e8b344dc5bb8b0385f5672\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"6c1791130b781c843572fb6391c4a4c5d857ab17\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"fe5c604053c36c62af24eee8a76407d026ea5163\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"348b59012e5c6402741d067cf6eeeb6271999d06\", \"lessThan\": \"25460d6f39024cc3b8241b14c7ccf0d6f11a736a\", \"versionType\": \"git\"}], \"programFiles\": [\"net/9p/client.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/9p/client.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867\"}, {\"url\": \"https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b\"}, {\"url\": \"https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17\"}, {\"url\": \"https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b\"}, {\"url\": \"https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672\"}, {\"url\": \"https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17\"}, {\"url\": \"https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163\"}, {\"url\": \"https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/9p: fix uninit-value in p9_client_rpc()\\n\\nSyzbot with the help of KMSAN reported the following error:\\n\\nBUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]\\nBUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\\n trace_9p_client_res include/trace/events/9p.h:146 [inline]\\n p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\\n path_mount+0x742/0x1f20 fs/namespace.c:3679\\n do_mount fs/namespace.c:3692 [inline]\\n __do_sys_mount fs/namespace.c:3898 [inline]\\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\\n do_syscall_64+0xd5/0x1f0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nUninit was created at:\\n __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598\\n __alloc_pages_node include/linux/gfp.h:238 [inline]\\n alloc_pages_node include/linux/gfp.h:261 [inline]\\n alloc_slab_page mm/slub.c:2175 [inline]\\n allocate_slab mm/slub.c:2338 [inline]\\n new_slab+0x2de/0x1400 mm/slub.c:2391\\n ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525\\n __slab_alloc mm/slub.c:3610 [inline]\\n __slab_alloc_node mm/slub.c:3663 [inline]\\n slab_alloc_node mm/slub.c:3835 [inline]\\n kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852\\n p9_tag_alloc net/9p/client.c:278 [inline]\\n p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641\\n p9_client_rpc+0x27e/0x1340 net/9p/client.c:688\\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\\n path_mount+0x742/0x1f20 fs/namespace.c:3679\\n do_mount fs/namespace.c:3692 [inline]\\n __do_sys_mount fs/namespace.c:3898 [inline]\\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\\n do_syscall_64+0xd5/0x1f0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nIf p9_check_errors() fails early in p9_client_rpc(), req-\u003erc.tag\\nwill not be properly initialized. However, trace_9p_client_res()\\nends up trying to print it out anyway before p9_client_rpc()\\nfinishes.\\n\\nFix this issue by assigning default values to p9_fcall fields\\nsuch as \u0027tag\u0027 and (just in case KMSAN unearths something new) \u0027id\u0027\\nduring the tag allocation stage.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:06:33.888Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39301\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:06:33.888Z\", \"dateReserved\": \"2024-06-24T13:53:25.535Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-25T14:22:41.566Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.