configfs: fix a race in configfs_{,un}register_subsystem() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 6 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic. One of cases is: A --> B --> C --> D A <-- B <-- C <-- D delete list_head *B | delete list_head *C --------------------------------|----------------------------------- configfs_unregister_subsystem | configfs_unregister_subsystem unlink_group | unlink_group unlink_obj | unlink_obj list_del_init | list_del_init __list_del_entry | __list_del_entry __list_del | __list_del // next == C | next->prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex.
Weaknesses (CWE)
- CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
References
- https://git.kernel.org/stable/c/40805099af11f68c5ca7dbcfacf455da8f99f622
- https://git.kernel.org/stable/c/d1654de19d42f513b6cfe955cc77e7f427e05a77
- https://git.kernel.org/stable/c/a37024f7757c25550accdebf49e497ad6ae239fe
- https://git.kernel.org/stable/c/b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a
- https://git.kernel.org/stable/c/a7ab53d3c27dfe83bb594456b9f38a37796ec39b
- https://git.kernel.org/stable/c/e7a66dd2687758718eddd79b542a95cf3aa488cc
- https://git.kernel.org/stable/c/3aadfd46858b1f64d4d6a0654b863e21aabff975
- https://git.kernel.org/stable/c/84ec758fb2daa236026506868c8796b0500c047d
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-53810
- GCVE · GCVE-0-2022-48931
CERT-FR advisories
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0840 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0822 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0800 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0779 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 2.6.16 < 4.9.304cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10 < 4.14.269cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.232cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.182cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.103cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.26cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 5.16.12
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < 40805099af11f68c5ca7dbcfacf455da8f99f622 ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < d1654de19d42f513b6cfe955cc77e7f427e05a77 ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < a37024f7757c25550accdebf49e497ad6ae239fe ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < b7e2b91fcb5c78c414e33dc8d50642e307ca0c5a ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < a7ab53d3c27dfe83bb594456b9f38a37796ec39b ; affected 7063fbf2261194f72ee75afca67b3b38b554b5fa < e7a66dd2687758718eddd79b542a95cf3aa488cc |
| Linux · Linux | affected 2.6.16 ; unaffected 0 < 2.6.16 ; unaffected 4.9.304 ≤ 4.9.* ; unaffected 4.14.269 ≤ 4.14.* ; unaffected 4.19.232 ≤ 4.19.* ; unaffected 5.4.182 ≤ 5.4.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |