cve-2024-40920
Vulnerability from cvelistv5
Published
2024-07-12 12:25
Modified
2024-11-05 09:33
Severity ?
Summary
net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8
Impacted products
Vendor Product Version
Linux Linux Version: 6.1.93   ≤
Version: 6.6.33   ≤
Version: 6.9.3   ≤
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:55.750Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40920",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:05:33.673278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:03.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caaa2129784a",
              "status": "affected",
              "version": "8ca9a750fc71",
              "versionType": "git"
            },
            {
              "lessThan": "7caefa277172",
              "status": "affected",
              "version": "4488617e5e99",
              "versionType": "git"
            },
            {
              "lessThan": "406bfc04b01e",
              "status": "affected",
              "version": "e43dd2b1ec74",
              "versionType": "git"
            },
            {
              "lessThan": "546ceb1dfdac",
              "status": "affected",
              "version": "3a7c1661ae13",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.95",
              "status": "affected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.35",
              "status": "affected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9.6",
              "status": "affected",
              "version": "6.9.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\n\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\nbut forgot to change the vlan group dereference helper. Switch to vlan\ngroup RCU deref helper to fix the suspicious rcu usage warning."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:33:10.392Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"
        },
        {
          "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"
        },
        {
          "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"
        }
      ],
      "title": "net: bridge: mst: fix suspicious rcu usage in br_mst_set_state",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40920",
    "datePublished": "2024-07-12T12:25:02.222Z",
    "dateReserved": "2024-07-12T12:17:45.582Z",
    "dateUpdated": "2024-11-05T09:33:10.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40920\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:15.003\",\"lastModified\":\"2024-11-21T09:31:51.670\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\\n\\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\\nbut forgot to change the vlan group dereference helper. Switch to vlan\\ngroup RCU deref helper to fix the suspicious rcu usage warning.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: bridge: mst: corrige el uso sospechoso de rcu en br_mst_set_state Convert\u00ed br_mst_set_state a RCU para evitar un use-after-free de VLAN, pero olvid\u00e9 cambiar el asistente de desreferencia del grupo VLAN. Cambie al asistente deref de RCU del grupo vlan para corregir la advertencia de uso sospechoso de rcu.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.