github - ghsa-j7v5-x62w-r9x3

ghsa-j7v5-x62w-r9x3

Vulnerability from github

Published

2024-11-08 06:30

Modified

2024-11-27 21:32

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix race when converting group handle to group object

XArray provides it's own internal lock which protects the internal array when entries are being simultaneously added and removed. However there is still a race between retrieving the pointer from the XArray and incrementing the reference count.

To avoid this race simply hold the internal XArray lock when incrementing the reference count, this ensures there cannot be a racing call to xa_erase().

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50174"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-08T06:15:14Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Fix race when converting group handle to group object\n\nXArray provides it\u0027s own internal lock which protects the internal array\nwhen entries are being simultaneously added and removed. However there\nis still a race between retrieving the pointer from the XArray and\nincrementing the reference count.\n\nTo avoid this race simply hold the internal XArray lock when\nincrementing the reference count, this ensures there cannot be a racing\ncall to xa_erase().",
  "id": "GHSA-j7v5-x62w-r9x3",
  "modified": "2024-11-27T21:32:43Z",
  "published": "2024-11-08T06:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50174"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/44742138d151c3a945460ae7beff8ae45ac0bf58"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8a585d553c11965332d7a2d74e79ef92a42bfc87"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cac075706f298948898b1f63e81709df42afa75d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-50174

Vulnerability from cvelistv5

Published

2024-11-08 05:23

Modified

2024-12-19 09:34

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race when converting group handle to group object XArray provides it's own internal lock which protects the internal array when entries are being simultaneously added and removed. However there is still a race between retrieving the pointer from the XArray and incrementing the reference count. To avoid this race simply hold the internal XArray lock when incrementing the reference count, this ensures there cannot be a racing call to xa_erase().

References

▼	URL	Tags
	https://git.kernel.org/stable/c/8a585d553c11965332d7a2d74e79ef92a42bfc87
	https://git.kernel.org/stable/c/44742138d151c3a945460ae7beff8ae45ac0bf58
	https://git.kernel.org/stable/c/cac075706f298948898b1f63e81709df42afa75d

Impacted products

Vendor

Product

Version

▼

Linux

Version: de85488138247d034eb3241840424a54d660926b
Version: de85488138247d034eb3241840424a54d660926b
Version: de85488138247d034eb3241840424a54d660926b

Linux

Version: 6.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8a585d553c11965332d7a2d74e79ef92a42bfc87",
              "status": "affected",
              "version": "de85488138247d034eb3241840424a54d660926b",
              "versionType": "git"
            },
            {
              "lessThan": "44742138d151c3a945460ae7beff8ae45ac0bf58",
              "status": "affected",
              "version": "de85488138247d034eb3241840424a54d660926b",
              "versionType": "git"
            },
            {
              "lessThan": "cac075706f298948898b1f63e81709df42afa75d",
              "status": "affected",
              "version": "de85488138247d034eb3241840424a54d660926b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Fix race when converting group handle to group object\n\nXArray provides it\u0027s own internal lock which protects the internal array\nwhen entries are being simultaneously added and removed. However there\nis still a race between retrieving the pointer from the XArray and\nincrementing the reference count.\n\nTo avoid this race simply hold the internal XArray lock when\nincrementing the reference count, this ensures there cannot be a racing\ncall to xa_erase()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:34:39.117Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8a585d553c11965332d7a2d74e79ef92a42bfc87"
        },
        {
          "url": "https://git.kernel.org/stable/c/44742138d151c3a945460ae7beff8ae45ac0bf58"
        },
        {
          "url": "https://git.kernel.org/stable/c/cac075706f298948898b1f63e81709df42afa75d"
        }
      ],
      "title": "drm/panthor: Fix race when converting group handle to group object",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50174",
    "datePublished": "2024-11-08T05:23:56.752Z",
    "dateReserved": "2024-10-21T19:36:19.963Z",
    "dateUpdated": "2024-12-19T09:34:39.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted