fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 19 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released. Fix the leak by adding an explicit kobject_put() call when kn is NULL.
References
- https://git.kernel.org/stable/c/f28bba37fe244889b81bb5c508d3f6e5c6e342c5
- https://git.kernel.org/stable/c/57baab0f376bec8f54b0fe6beb8f77a57c228063
- https://git.kernel.org/stable/c/84bd4c2ae9c3d0a7d3a5c032ea7efff17af17e17
- https://git.kernel.org/stable/c/43f00210cb257bcb0387e8caeb4b46375d67f30c
- https://git.kernel.org/stable/c/5d43e072285e81b0b63cee7189b3357c7768a43b
- https://git.kernel.org/stable/c/ac107356aabc362aaeb77463e814fc067a5d3957
- https://git.kernel.org/stable/c/a4c99b57d43bab45225ba92d574a8683f9edc8e4
- https://git.kernel.org/stable/c/a90bca2228c0646fc29a72689d308e5fe03e6d78
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-24255
- GCVE · GCVE-0-2024-26993
CERT-FR advisories
- CERTFR-2025-AVI-0304 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0821 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0799 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0741 — Multiples vulnérabilités dans Juniper Secure Analytics · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0695 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0646 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0645 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0633 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0611 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0528 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0527 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0526 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0471 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0458 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0457 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0440 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0420 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0381 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 3.16.62 < 3.17cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 3.18.121 < 3.19cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.4.154 < 4.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.9.125 < 4.10cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.14.68 < 4.15cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.18.6 < 4.19cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19 < 5.15.157cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.88cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.29cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.8.8cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 2afc9166f79b8f6da5f347f48515215ceee4ae37 < f28bba37fe244889b81bb5c508d3f6e5c6e342c5 ; affected 2afc9166f79b8f6da5f347f48515215ceee4ae37 < 57baab0f376bec8f54b0fe6beb8f77a57c228063 ; affected 2afc9166f79b8f6da5f347f48515215ceee4ae37 < 84bd4c2ae9c3d0a7d3a5c032ea7efff17af17e17 ; affected 2afc9166f79b8f6da5f347f48515215ceee4ae37 < 43f00210cb257bcb0387e8caeb4b46375d67f30c ; affected 2afc9166f79b8f6da5f347f48515215ceee4ae37 < 5d43e072285e81b0b63cee7189b3357c7768a43b ; affected 2afc9166f79b8f6da5f347f48515215ceee4ae37 < ac107356aabc362aaeb77463e814fc067a5d3957 |
| Linux · Linux | affected 4.19 ; unaffected 0 < 4.19 ; unaffected 4.19.313 ≤ 4.19.* ; unaffected 5.4.275 ≤ 5.4.* ; unaffected 5.10.216 ≤ 5.10.* ; unaffected 5.15.157 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |