qibfs: fix dentry leak (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.48 % · percentile 41 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: qibfs: fix dentry leak simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exactly the right thing to do, but here the argument comes from dcache lookup, that needs to be balanced by explicit dput(). Fucked-up-by: Al Viro <viro@zeniv.linux.org.uk>
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/24dd9b08df718f20ccf2dd1519909fefd8c233ee
- https://git.kernel.org/stable/c/bd8f78c71defbcb7a9ed331e7f287507df972b00
- https://git.kernel.org/stable/c/db71ca93259dd1078bcfea3afafde2143cfc2da7
- https://git.kernel.org/stable/c/02ee394a5d899d9bd2f0759382e9481cab6166f8
- https://git.kernel.org/stable/c/aa23317d0268b309bb3f0801ddd0d61813ff5afb
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2024-36297
- GCVE · GCVE-0-2024-36947
CERT-FR advisories
- CERTFR-2024-AVI-0799 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0716 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0694 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0669 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0667 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0526 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0496 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.13 < 5.15.159cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.91cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.31cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.8.10cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e41d237818598c0b17458b4d0416b091a7959e55 < 24dd9b08df718f20ccf2dd1519909fefd8c233ee ; affected e41d237818598c0b17458b4d0416b091a7959e55 < bd8f78c71defbcb7a9ed331e7f287507df972b00 ; affected e41d237818598c0b17458b4d0416b091a7959e55 < db71ca93259dd1078bcfea3afafde2143cfc2da7 ; affected e41d237818598c0b17458b4d0416b091a7959e55 < 02ee394a5d899d9bd2f0759382e9481cab6166f8 ; affected e41d237818598c0b17458b4d0416b091a7959e55 < aa23317d0268b309bb3f0801ddd0d61813ff5afb |
| Linux · Linux | affected 5.13 ; unaffected 0 < 5.13 ; unaffected 5.15.159 ≤ 5.15.* ; unaffected 6.1.91 ≤ 6.1.* ; unaffected 6.6.31 ≤ 6.6.* ; unaffected 6.8.10 ≤ 6.8.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |