GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-42271 (GCVE-0-2024-42271)

Vulnerability from cvelistv5 – Published: 2024-08-17 08:54 – Updated: 2026-08-05 11:36
VLAI
Title
net/iucv: fix use after free in iucv_sock_close()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of severing the path (or it is already removed / never existed). This needs to be done with atomic compare and swap, otherwise there is a small window where iucv_sock_close() will try to work with a path that has already been severed and freed by iucv_callback_connrej() called by iucv_tasklet_fn(). Example: [452744.123844] Call Trace: [452744.123845] ([<0000001e87f03880>] 0x1e87f03880) [452744.123966] [<00000000d593001e>] iucv_path_sever+0x96/0x138 [452744.124330] [<000003ff801ddbca>] iucv_sever_path+0xc2/0xd0 [af_iucv] [452744.124336] [<000003ff801e01b6>] iucv_sock_close+0xa6/0x310 [af_iucv] [452744.124341] [<000003ff801e08cc>] iucv_sock_release+0x3c/0xd0 [af_iucv] [452744.124345] [<00000000d574794e>] __sock_release+0x5e/0xe8 [452744.124815] [<00000000d5747a0c>] sock_close+0x34/0x48 [452744.124820] [<00000000d5421642>] __fput+0xba/0x268 [452744.124826] [<00000000d51b382c>] task_work_run+0xbc/0xf0 [452744.124832] [<00000000d5145710>] do_notify_resume+0x88/0x90 [452744.124841] [<00000000d5978096>] system_call+0xe2/0x2c8 [452744.125319] Last Breaking-Event-Address: [452744.125321] [<00000000d5930018>] iucv_path_sever+0x90/0x138 [452744.125324] [452744.125325] Kernel panic - not syncing: Fatal exception in interrupt Note that bh_lock_sock() is not serializing the tasklet context against process context, because the check for sock_owned_by_user() and corresponding handling is missing. Ideas for a future clean-up patch: A) Correct usage of bh_lock_sock() in tasklet context, as described in Re-enqueue, if needed. This may require adding return values to the tasklet functions and thus changes to all users of iucv. B) Change iucv tasklet into worker and use only lock_sock() in af_iucv.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:12 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < 84f40b46787ecb67c7ad08a5bb1376141fa10c01 (git)
Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < 37652fbef9809411cea55ea5fa1a170e299efcd0 (git)
Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < c65f72eec60a34ace031426e04e9aff8e5f04895 (git)
Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < ac758e1f663fe9bc64f6b47212a2aa18697524f5 (git)
Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < 8b424c9e44111c5a76f41c6b741f8d4c4179d876 (git)
Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < 01437282fd3904810603f3dc98d2cac6b8b6fc84 (git)
Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < 69620522c48ce8215e5eb55ffbab8cafee8f407d (git)
Affected: 7d316b9453523498246e9e19a659c423d4c5081e , < f558120cd709682b739207b48cf7479fd9568431 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.4
Unaffected: 0 , < 3.4 (semver)
Unaffected: 4.19.320 , ≤ 4.19.* (semver)
Unaffected: 5.4.282 , ≤ 5.4.* (semver)
Unaffected: 5.10.224 , ≤ 5.10.* (semver)
Unaffected: 5.15.165 , ≤ 5.15.* (semver)
Unaffected: 6.1.104 , ≤ 6.1.* (semver)
Unaffected: 6.6.45 , ≤ 6.6.* (semver)
Unaffected: 6.10.4 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42271",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:12:11.442193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:32.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:03:07.104Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84f40b46787ecb67c7ad08a5bb1376141fa10c01",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            },
            {
              "lessThan": "37652fbef9809411cea55ea5fa1a170e299efcd0",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            },
            {
              "lessThan": "c65f72eec60a34ace031426e04e9aff8e5f04895",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            },
            {
              "lessThan": "ac758e1f663fe9bc64f6b47212a2aa18697524f5",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            },
            {
              "lessThan": "8b424c9e44111c5a76f41c6b741f8d4c4179d876",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            },
            {
              "lessThan": "01437282fd3904810603f3dc98d2cac6b8b6fc84",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            },
            {
              "lessThan": "69620522c48ce8215e5eb55ffbab8cafee8f407d",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            },
            {
              "lessThan": "f558120cd709682b739207b48cf7479fd9568431",
              "status": "affected",
              "version": "7d316b9453523498246e9e19a659c423d4c5081e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.104",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.45",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.4",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use after free in iucv_sock_close()\n\niucv_sever_path() is called from process context and from bh context.\niucv-\u003epath is used as indicator whether somebody else is taking care of\nsevering the path (or it is already removed / never existed).\nThis needs to be done with atomic compare and swap, otherwise there is a\nsmall window where iucv_sock_close() will try to work with a path that has\nalready been severed and freed by iucv_callback_connrej() called by\niucv_tasklet_fn().\n\nExample:\n[452744.123844] Call Trace:\n[452744.123845] ([\u003c0000001e87f03880\u003e] 0x1e87f03880)\n[452744.123966]  [\u003c00000000d593001e\u003e] iucv_path_sever+0x96/0x138\n[452744.124330]  [\u003c000003ff801ddbca\u003e] iucv_sever_path+0xc2/0xd0 [af_iucv]\n[452744.124336]  [\u003c000003ff801e01b6\u003e] iucv_sock_close+0xa6/0x310 [af_iucv]\n[452744.124341]  [\u003c000003ff801e08cc\u003e] iucv_sock_release+0x3c/0xd0 [af_iucv]\n[452744.124345]  [\u003c00000000d574794e\u003e] __sock_release+0x5e/0xe8\n[452744.124815]  [\u003c00000000d5747a0c\u003e] sock_close+0x34/0x48\n[452744.124820]  [\u003c00000000d5421642\u003e] __fput+0xba/0x268\n[452744.124826]  [\u003c00000000d51b382c\u003e] task_work_run+0xbc/0xf0\n[452744.124832]  [\u003c00000000d5145710\u003e] do_notify_resume+0x88/0x90\n[452744.124841]  [\u003c00000000d5978096\u003e] system_call+0xe2/0x2c8\n[452744.125319] Last Breaking-Event-Address:\n[452744.125321]  [\u003c00000000d5930018\u003e] iucv_path_sever+0x90/0x138\n[452744.125324]\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\n\nNote that bh_lock_sock() is not serializing the tasklet context against\nprocess context, because the check for sock_owned_by_user() and\ncorresponding handling is missing.\n\nIdeas for a future clean-up patch:\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\nRe-enqueue, if needed. This may require adding return values to the\ntasklet functions and thus changes to all users of iucv.\n\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through AF_IUCV socket syscalls (socket/connect/accept/close) on an s390 z/VM guest; the racing tasklet side is driven by IUCV path-sever events the attacker generates from a peer socket on the same system. Although the IUCV peer can be another z/VM guest, the fully attacker-controlled path is local.\nAC:L - The attacker controls both sides of the race \u2014 one thread calls close() on the socket while a second socket\u0027s close (or a cooperating peer) causes CP to deliver the path-severed interrupt into iucv_tasklet_fn \u2014 and the attempt can be repeated in a tight loop until the small window is hit.\nPR:L - AF_IUCV socket creation and all socket operations in af_iucv.c contain no capability or privilege checks, and the module is auto-loadable via the net-pf-32 alias, so any unprivileged local user can reach the code.\nUI:N - The attacker drives the entire sequence from its own processes and sockets; no victim action is required.\nS:U - The corruption stays within the kernel\u0027s own security authority; no hypervisor, IOMMU, or VM boundary is crossed.\nC:H - The double-free/UAF of struct iucv_path in the generic kmalloc-64 cache lets an attacker reclaim the object and have the kernel dereference attacker-controlled fields (path-\u003epathid, path-\u003eprivate as a struct sock *), which can be leveraged for kernel memory disclosure.\nI:H - Freed-object reuse yields write primitives: unbounded `iucv_path_table[path-\u003epathid] = NULL` indexed by a reclaimed u16, list_del_init() unlinking on attacker-controlled list pointers, and freelist corruption from the double free \u2014 all exploitable toward arbitrary write and privilege escalation.\nA:H - The reported failure is \"Kernel panic - not syncing: Fatal exception in interrupt\" from iucv_path_sever(), so triggering the race reliably crashes the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:12.103Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84f40b46787ecb67c7ad08a5bb1376141fa10c01"
        },
        {
          "url": "https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac758e1f663fe9bc64f6b47212a2aa18697524f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b424c9e44111c5a76f41c6b741f8d4c4179d876"
        },
        {
          "url": "https://git.kernel.org/stable/c/01437282fd3904810603f3dc98d2cac6b8b6fc84"
        },
        {
          "url": "https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f558120cd709682b739207b48cf7479fd9568431"
        }
      ],
      "title": "net/iucv: fix use after free in iucv_sock_close()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42271",
    "datePublished": "2024-08-17T08:54:26.048Z",
    "dateReserved": "2024-07-30T07:40:12.260Z",
    "dateUpdated": "2026-08-05T11:36:12.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42271",
      "date": "2026-09-15",
      "epss": "0.00235",
      "percentile": "0.14591"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.4\", \"versionEndExcluding\": \"4.19.320\", \"matchCriteriaId\": \"D4F8C11A-E708-4EBE-97BC-D7F6041074D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.282\", \"matchCriteriaId\": \"A8961D98-9ACF-4188-BA88-44038B14BC28\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.224\", \"matchCriteriaId\": \"5CCEDF13-293D-4E64-B501-4409D0365AFE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.165\", \"matchCriteriaId\": \"B4E2B568-3171-41DE-B519-F2B1A3600D94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.104\", \"matchCriteriaId\": \"20DB9042-F89E-4024-B005-ACBBA99CA659\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.45\", \"matchCriteriaId\": \"6ED8FBDF-48EE-4FEB-8B1A-CFF4FBCB27BF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.4\", \"matchCriteriaId\": \"1F9FECDC-6CB8-41E5-B32A-E46776100D9C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/iucv: fix use after free in iucv_sock_close()\\n\\niucv_sever_path() is called from process context and from bh context.\\niucv-\u003epath is used as indicator whether somebody else is taking care of\\nsevering the path (or it is already removed / never existed).\\nThis needs to be done with atomic compare and swap, otherwise there is a\\nsmall window where iucv_sock_close() will try to work with a path that has\\nalready been severed and freed by iucv_callback_connrej() called by\\niucv_tasklet_fn().\\n\\nExample:\\n[452744.123844] Call Trace:\\n[452744.123845] ([\u003c0000001e87f03880\u003e] 0x1e87f03880)\\n[452744.123966]  [\u003c00000000d593001e\u003e] iucv_path_sever+0x96/0x138\\n[452744.124330]  [\u003c000003ff801ddbca\u003e] iucv_sever_path+0xc2/0xd0 [af_iucv]\\n[452744.124336]  [\u003c000003ff801e01b6\u003e] iucv_sock_close+0xa6/0x310 [af_iucv]\\n[452744.124341]  [\u003c000003ff801e08cc\u003e] iucv_sock_release+0x3c/0xd0 [af_iucv]\\n[452744.124345]  [\u003c00000000d574794e\u003e] __sock_release+0x5e/0xe8\\n[452744.124815]  [\u003c00000000d5747a0c\u003e] sock_close+0x34/0x48\\n[452744.124820]  [\u003c00000000d5421642\u003e] __fput+0xba/0x268\\n[452744.124826]  [\u003c00000000d51b382c\u003e] task_work_run+0xbc/0xf0\\n[452744.124832]  [\u003c00000000d5145710\u003e] do_notify_resume+0x88/0x90\\n[452744.124841]  [\u003c00000000d5978096\u003e] system_call+0xe2/0x2c8\\n[452744.125319] Last Breaking-Event-Address:\\n[452744.125321]  [\u003c00000000d5930018\u003e] iucv_path_sever+0x90/0x138\\n[452744.125324]\\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\\n\\nNote that bh_lock_sock() is not serializing the tasklet context against\\nprocess context, because the check for sock_owned_by_user() and\\ncorresponding handling is missing.\\n\\nIdeas for a future clean-up patch:\\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\\nRe-enqueue, if needed. This may require adding return values to the\\ntasklet functions and thus changes to all users of iucv.\\n\\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/iucv: corrige el use after free en iucv_sock_close() iucv_sever_path() se llama desde el contexto del proceso y desde el contexto bh. iucv-\u0026gt;path se utiliza como indicador de si alguien m\\u00e1s se est\\u00e1 encargando de cortar la ruta (o si ya se elimin\\u00f3 o nunca existi\\u00f3). Esto debe hacerse con comparaci\\u00f3n e intercambio at\\u00f3mico; de lo contrario, hay una peque\\u00f1a ventana donde iucv_sock_close() intentar\\u00e1 trabajar con una ruta que ya ha sido cortada y liberada por iucv_callback_connrej() llamada por iucv_tasklet_fn(). Ejemplo: [452744.123844] Seguimiento de llamadas: [452744.123845] ([\u0026lt;0000001e87f03880\u0026gt;] 0x1e87f03880) [452744.123966] [\u0026lt;00000000d593001e\u0026gt;] iucv_path_sever+0x96/0x13 8 [452744.124330] [\u0026lt;000003ff801ddbca\u0026gt;] iucv_sever_path+0xc2/0xd0 [af_iucv] [452744.124336 ] [\u0026lt;000003ff801e01b6\u0026gt;] iucv_sock_close+0xa6/0x310 [af_iucv] [452744.124341] [\u0026lt;000003ff801e08cc\u0026gt;] iucv_sock_release+0x3c/0xd0 [af_iucv] [452744.124345] 000000d574794e\u0026gt;] __sock_release+0x5e/0xe8 [452744.124815] [\u0026lt;00000000d5747a0c\u0026gt; ] sock_close+0x34/0x48 [452744.124820] [\u0026lt;00000000d5421642\u0026gt;] __fput+0xba/0x268 [452744.124826] [\u0026lt;00000000d51b382c\u0026gt;] task_work_run+0xbc/0xf0 [452744.1 24832] [\u0026lt;00000000d5145710\u0026gt;] do_notify_resume+0x88/0x90 [452744.124841] [\u0026lt; 00000000d5978096\u0026gt;] system_call+0xe2/0x2c8 [452744.125319] \\u00daltima direcci\\u00f3n del evento de \\u00faltima hora: [452744.125321] [\u0026lt;00000000d5930018\u0026gt;] iucv_path_sever+0x90/0x138 [452744.125 324] [452744.125325] P\\u00e1nico del kernel: no se sincroniza: excepci\\u00f3n fatal en la interrupci\\u00f3n. Tenga en cuenta que bh_lock_sock () no serializa el contexto del tasklet con respecto al contexto del proceso, porque falta la verificaci\\u00f3n de sock_owned_by_user() y el manejo correspondiente. Ideas para un futuro parche de limpieza: A) Uso correcto de bh_lock_sock() en el contexto del tasklet, como se describe en Volver a poner en cola, si es necesario. Esto puede requerir agregar valores de retorno a las funciones del tasklet y, por lo tanto, cambios para todos los usuarios de iucv. B) Cambie el tasklet iucv a trabajador y use solo lock_sock() en af_iucv.\"}]",
      "id": "CVE-2024-42271",
      "lastModified": "2024-08-19T20:03:31.840",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-08-17T09:15:08.307",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/01437282fd3904810603f3dc98d2cac6b8b6fc84\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/84f40b46787ecb67c7ad08a5bb1376141fa10c01\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8b424c9e44111c5a76f41c6b741f8d4c4179d876\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ac758e1f663fe9bc64f6b47212a2aa18697524f5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f558120cd709682b739207b48cf7479fd9568431\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42271\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T09:15:08.307\",\"lastModified\":\"2026-08-04T11:19:44.120\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/iucv: fix use after free in iucv_sock_close()\\n\\niucv_sever_path() is called from process context and from bh context.\\niucv-\u003epath is used as indicator whether somebody else is taking care of\\nsevering the path (or it is already removed / never existed).\\nThis needs to be done with atomic compare and swap, otherwise there is a\\nsmall window where iucv_sock_close() will try to work with a path that has\\nalready been severed and freed by iucv_callback_connrej() called by\\niucv_tasklet_fn().\\n\\nExample:\\n[452744.123844] Call Trace:\\n[452744.123845] ([\u003c0000001e87f03880\u003e] 0x1e87f03880)\\n[452744.123966]  [\u003c00000000d593001e\u003e] iucv_path_sever+0x96/0x138\\n[452744.124330]  [\u003c000003ff801ddbca\u003e] iucv_sever_path+0xc2/0xd0 [af_iucv]\\n[452744.124336]  [\u003c000003ff801e01b6\u003e] iucv_sock_close+0xa6/0x310 [af_iucv]\\n[452744.124341]  [\u003c000003ff801e08cc\u003e] iucv_sock_release+0x3c/0xd0 [af_iucv]\\n[452744.124345]  [\u003c00000000d574794e\u003e] __sock_release+0x5e/0xe8\\n[452744.124815]  [\u003c00000000d5747a0c\u003e] sock_close+0x34/0x48\\n[452744.124820]  [\u003c00000000d5421642\u003e] __fput+0xba/0x268\\n[452744.124826]  [\u003c00000000d51b382c\u003e] task_work_run+0xbc/0xf0\\n[452744.124832]  [\u003c00000000d5145710\u003e] do_notify_resume+0x88/0x90\\n[452744.124841]  [\u003c00000000d5978096\u003e] system_call+0xe2/0x2c8\\n[452744.125319] Last Breaking-Event-Address:\\n[452744.125321]  [\u003c00000000d5930018\u003e] iucv_path_sever+0x90/0x138\\n[452744.125324]\\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\\n\\nNote that bh_lock_sock() is not serializing the tasklet context against\\nprocess context, because the check for sock_owned_by_user() and\\ncorresponding handling is missing.\\n\\nIdeas for a future clean-up patch:\\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\\nRe-enqueue, if needed. This may require adding return values to the\\ntasklet functions and thus changes to all users of iucv.\\n\\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/iucv: corrige el use after free en iucv_sock_close() iucv_sever_path() se llama desde el contexto del proceso y desde el contexto bh. iucv-\u0026gt;path se utiliza como indicador de si alguien m\u00e1s se est\u00e1 encargando de cortar la ruta (o si ya se elimin\u00f3 o nunca existi\u00f3). Esto debe hacerse con comparaci\u00f3n e intercambio at\u00f3mico; de lo contrario, hay una peque\u00f1a ventana donde iucv_sock_close() intentar\u00e1 trabajar con una ruta que ya ha sido cortada y liberada por iucv_callback_connrej() llamada por iucv_tasklet_fn(). Ejemplo: [452744.123844] Seguimiento de llamadas: [452744.123845] ([\u0026lt;0000001e87f03880\u0026gt;] 0x1e87f03880) [452744.123966] [\u0026lt;00000000d593001e\u0026gt;] iucv_path_sever+0x96/0x13 8 [452744.124330] [\u0026lt;000003ff801ddbca\u0026gt;] iucv_sever_path+0xc2/0xd0 [af_iucv] [452744.124336 ] [\u0026lt;000003ff801e01b6\u0026gt;] iucv_sock_close+0xa6/0x310 [af_iucv] [452744.124341] [\u0026lt;000003ff801e08cc\u0026gt;] iucv_sock_release+0x3c/0xd0 [af_iucv] [452744.124345] 000000d574794e\u0026gt;] __sock_release+0x5e/0xe8 [452744.124815] [\u0026lt;00000000d5747a0c\u0026gt; ] sock_close+0x34/0x48 [452744.124820] [\u0026lt;00000000d5421642\u0026gt;] __fput+0xba/0x268 [452744.124826] [\u0026lt;00000000d51b382c\u0026gt;] task_work_run+0xbc/0xf0 [452744.1 24832] [\u0026lt;00000000d5145710\u0026gt;] do_notify_resume+0x88/0x90 [452744.124841] [\u0026lt; 00000000d5978096\u0026gt;] system_call+0xe2/0x2c8 [452744.125319] \u00daltima direcci\u00f3n del evento de \u00faltima hora: [452744.125321] [\u0026lt;00000000d5930018\u0026gt;] iucv_path_sever+0x90/0x138 [452744.125 324] [452744.125325] P\u00e1nico del kernel: no se sincroniza: excepci\u00f3n fatal en la interrupci\u00f3n. Tenga en cuenta que bh_lock_sock () no serializa el contexto del tasklet con respecto al contexto del proceso, porque falta la verificaci\u00f3n de sock_owned_by_user() y el manejo correspondiente. Ideas para un futuro parche de limpieza: A) Uso correcto de bh_lock_sock() en el contexto del tasklet, como se describe en Volver a poner en cola, si es necesario. Esto puede requerir agregar valores de retorno a las funciones del tasklet y, por lo tanto, cambios para todos los usuarios de iucv. B) Cambie el tasklet iucv a trabajador y use solo lock_sock() en af_iucv.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/iucv/af_iucv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"84f40b46787ecb67c7ad08a5bb1376141fa10c01\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"37652fbef9809411cea55ea5fa1a170e299efcd0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"c65f72eec60a34ace031426e04e9aff8e5f04895\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"ac758e1f663fe9bc64f6b47212a2aa18697524f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"8b424c9e44111c5a76f41c6b741f8d4c4179d876\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"01437282fd3904810603f3dc98d2cac6b8b6fc84\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"69620522c48ce8215e5eb55ffbab8cafee8f407d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d316b9453523498246e9e19a659c423d4c5081e\",\"lessThan\":\"f558120cd709682b739207b48cf7479fd9568431\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/iucv/af_iucv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.320\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.282\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.224\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.165\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.104\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.45\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.4\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:12:11.442193Z\",\"id\":\"CVE-2024-42271\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4\",\"versionEndExcluding\":\"4.19.320\",\"matchCriteriaId\":\"D4F8C11A-E708-4EBE-97BC-D7F6041074D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.282\",\"matchCriteriaId\":\"A8961D98-9ACF-4188-BA88-44038B14BC28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.224\",\"matchCriteriaId\":\"5CCEDF13-293D-4E64-B501-4409D0365AFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.165\",\"matchCriteriaId\":\"B4E2B568-3171-41DE-B519-F2B1A3600D94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.104\",\"matchCriteriaId\":\"20DB9042-F89E-4024-B005-ACBBA99CA659\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.45\",\"matchCriteriaId\":\"6ED8FBDF-48EE-4FEB-8B1A-CFF4FBCB27BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.4\",\"matchCriteriaId\":\"1F9FECDC-6CB8-41E5-B32A-E46776100D9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01437282fd3904810603f3dc98d2cac6b8b6fc84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/84f40b46787ecb67c7ad08a5bb1376141fa10c01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b424c9e44111c5a76f41c6b741f8d4c4179d876\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac758e1f663fe9bc64f6b47212a2aa18697524f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f558120cd709682b739207b48cf7479fd9568431\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:33:31+00:00",
      "cve": "CVE-2024-42271",
      "id": "CVE-2024-42271",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:fixed": "793",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/iucv: fix use after free in iucv_sock_close()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42271.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T13:54:01Z",
      "cve": "CVE-2024-42271",
      "id": "CVE-2024-42271",
      "initial_release_date": "2024-08-18T02:02:50Z",
      "product_status:known_affected": "403",
      "product_status:known_not_affected": "46",
      "product_status:recommended": "993",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42271",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42271.json",
      "version": "80"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:03:07.104Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42271\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:12:11.442193Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.896Z\"}}], \"cna\": {\"title\": \"net/iucv: fix use after free in iucv_sock_close()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached through AF_IUCV socket syscalls (socket/connect/accept/close) on an s390 z/VM guest; the racing tasklet side is driven by IUCV path-sever events the attacker generates from a peer socket on the same system. Although the IUCV peer can be another z/VM guest, the fully attacker-controlled path is local.\\nAC:L - The attacker controls both sides of the race \\u2014 one thread calls close() on the socket while a second socket\u0027s close (or a cooperating peer) causes CP to deliver the path-severed interrupt into iucv_tasklet_fn \\u2014 and the attempt can be repeated in a tight loop until the small window is hit.\\nPR:L - AF_IUCV socket creation and all socket operations in af_iucv.c contain no capability or privilege checks, and the module is auto-loadable via the net-pf-32 alias, so any unprivileged local user can reach the code.\\nUI:N - The attacker drives the entire sequence from its own processes and sockets; no victim action is required.\\nS:U - The corruption stays within the kernel\u0027s own security authority; no hypervisor, IOMMU, or VM boundary is crossed.\\nC:H - The double-free/UAF of struct iucv_path in the generic kmalloc-64 cache lets an attacker reclaim the object and have the kernel dereference attacker-controlled fields (path-\u003epathid, path-\u003eprivate as a struct sock *), which can be leveraged for kernel memory disclosure.\\nI:H - Freed-object reuse yields write primitives: unbounded `iucv_path_table[path-\u003epathid] = NULL` indexed by a reclaimed u16, list_del_init() unlinking on attacker-controlled list pointers, and freelist corruption from the double free \\u2014 all exploitable toward arbitrary write and privilege escalation.\\nA:H - The reported failure is \\\"Kernel panic - not syncing: Fatal exception in interrupt\\\" from iucv_path_sever(), so triggering the race reliably crashes the whole system.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"84f40b46787ecb67c7ad08a5bb1376141fa10c01\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"37652fbef9809411cea55ea5fa1a170e299efcd0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"c65f72eec60a34ace031426e04e9aff8e5f04895\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"ac758e1f663fe9bc64f6b47212a2aa18697524f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"8b424c9e44111c5a76f41c6b741f8d4c4179d876\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"01437282fd3904810603f3dc98d2cac6b8b6fc84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"69620522c48ce8215e5eb55ffbab8cafee8f407d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d316b9453523498246e9e19a659c423d4c5081e\", \"lessThan\": \"f558120cd709682b739207b48cf7479fd9568431\", \"versionType\": \"git\"}], \"programFiles\": [\"net/iucv/af_iucv.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.320\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.282\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.224\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.104\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.45\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/iucv/af_iucv.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/84f40b46787ecb67c7ad08a5bb1376141fa10c01\"}, {\"url\": \"https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0\"}, {\"url\": \"https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895\"}, {\"url\": \"https://git.kernel.org/stable/c/ac758e1f663fe9bc64f6b47212a2aa18697524f5\"}, {\"url\": \"https://git.kernel.org/stable/c/8b424c9e44111c5a76f41c6b741f8d4c4179d876\"}, {\"url\": \"https://git.kernel.org/stable/c/01437282fd3904810603f3dc98d2cac6b8b6fc84\"}, {\"url\": \"https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407d\"}, {\"url\": \"https://git.kernel.org/stable/c/f558120cd709682b739207b48cf7479fd9568431\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/iucv: fix use after free in iucv_sock_close()\\n\\niucv_sever_path() is called from process context and from bh context.\\niucv-\u003epath is used as indicator whether somebody else is taking care of\\nsevering the path (or it is already removed / never existed).\\nThis needs to be done with atomic compare and swap, otherwise there is a\\nsmall window where iucv_sock_close() will try to work with a path that has\\nalready been severed and freed by iucv_callback_connrej() called by\\niucv_tasklet_fn().\\n\\nExample:\\n[452744.123844] Call Trace:\\n[452744.123845] ([\u003c0000001e87f03880\u003e] 0x1e87f03880)\\n[452744.123966]  [\u003c00000000d593001e\u003e] iucv_path_sever+0x96/0x138\\n[452744.124330]  [\u003c000003ff801ddbca\u003e] iucv_sever_path+0xc2/0xd0 [af_iucv]\\n[452744.124336]  [\u003c000003ff801e01b6\u003e] iucv_sock_close+0xa6/0x310 [af_iucv]\\n[452744.124341]  [\u003c000003ff801e08cc\u003e] iucv_sock_release+0x3c/0xd0 [af_iucv]\\n[452744.124345]  [\u003c00000000d574794e\u003e] __sock_release+0x5e/0xe8\\n[452744.124815]  [\u003c00000000d5747a0c\u003e] sock_close+0x34/0x48\\n[452744.124820]  [\u003c00000000d5421642\u003e] __fput+0xba/0x268\\n[452744.124826]  [\u003c00000000d51b382c\u003e] task_work_run+0xbc/0xf0\\n[452744.124832]  [\u003c00000000d5145710\u003e] do_notify_resume+0x88/0x90\\n[452744.124841]  [\u003c00000000d5978096\u003e] system_call+0xe2/0x2c8\\n[452744.125319] Last Breaking-Event-Address:\\n[452744.125321]  [\u003c00000000d5930018\u003e] iucv_path_sever+0x90/0x138\\n[452744.125324]\\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\\n\\nNote that bh_lock_sock() is not serializing the tasklet context against\\nprocess context, because the check for sock_owned_by_user() and\\ncorresponding handling is missing.\\n\\nIdeas for a future clean-up patch:\\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\\nRe-enqueue, if needed. This may require adding return values to the\\ntasklet functions and thus changes to all users of iucv.\\n\\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.320\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.282\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.224\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.104\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.45\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.4\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"3.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:36:12.103Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42271\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:36:12.103Z\", \"dateReserved\": \"2024-07-30T07:40:12.260Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T08:54:26.048Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.