In the Linux kernel, the following vulnerability has been resolved:
tomoyo: fix UAF write bug in tomoyowritecontrol()
Since tomoyowritecontrol() updates head->writebuf when write() of long lines is requested, we need to fetch head->writebuf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems.
[
{
"id": "CVE-2024-26622-00ede6ca",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815",
"digest": {
"line_hashes": [
"236113540151239842951529612181041668437",
"70829799812660724861774414618684652126",
"66452508630603502104485600045000300282",
"142453765488468385279960999136152186954",
"99394050491175099895628554385915650763",
"262114813759691425262759728092587421823",
"65597308325985753576507370616932489401",
"120078525613573943353948800448804355862",
"157958725692649172051674765338126882448"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26622-3a2eef23",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c",
"function": "tomoyo_write_control"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d930a4da17958f869ef679ee0e4a8729337affc",
"digest": {
"length": 1859.0,
"function_hash": "139944227049634160538707385537674183889"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-26622-4179aa65",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6edefe1b6c29a9932f558a898968a9fcbeec5711",
"digest": {
"line_hashes": [
"236113540151239842951529612181041668437",
"70829799812660724861774414618684652126",
"66452508630603502104485600045000300282",
"142453765488468385279960999136152186954",
"99394050491175099895628554385915650763",
"262114813759691425262759728092587421823",
"65597308325985753576507370616932489401",
"120078525613573943353948800448804355862",
"157958725692649172051674765338126882448"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26622-42f73eed",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c",
"function": "tomoyo_write_control"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2caa605079488da9601099fbda460cfc1702839f",
"digest": {
"length": 1859.0,
"function_hash": "139944227049634160538707385537674183889"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-26622-54ccc364",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c",
"function": "tomoyo_write_control"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a23ac1788e2c828c097119e9a3178f0b7e503fee",
"digest": {
"length": 1859.0,
"function_hash": "139944227049634160538707385537674183889"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-26622-7df2d10c",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a23ac1788e2c828c097119e9a3178f0b7e503fee",
"digest": {
"line_hashes": [
"236113540151239842951529612181041668437",
"70829799812660724861774414618684652126",
"66452508630603502104485600045000300282",
"142453765488468385279960999136152186954",
"99394050491175099895628554385915650763",
"262114813759691425262759728092587421823",
"65597308325985753576507370616932489401",
"120078525613573943353948800448804355862",
"157958725692649172051674765338126882448"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26622-83b250ba",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d930a4da17958f869ef679ee0e4a8729337affc",
"digest": {
"line_hashes": [
"236113540151239842951529612181041668437",
"70829799812660724861774414618684652126",
"66452508630603502104485600045000300282",
"142453765488468385279960999136152186954",
"99394050491175099895628554385915650763",
"262114813759691425262759728092587421823",
"65597308325985753576507370616932489401",
"120078525613573943353948800448804355862",
"157958725692649172051674765338126882448"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26622-8f4a1e03",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2caa605079488da9601099fbda460cfc1702839f",
"digest": {
"line_hashes": [
"236113540151239842951529612181041668437",
"70829799812660724861774414618684652126",
"66452508630603502104485600045000300282",
"142453765488468385279960999136152186954",
"99394050491175099895628554385915650763",
"262114813759691425262759728092587421823",
"65597308325985753576507370616932489401",
"120078525613573943353948800448804355862",
"157958725692649172051674765338126882448"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26622-a6a53c46",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bfe04c1273d30b866f4c7c238331ed3b08e5824",
"digest": {
"line_hashes": [
"236113540151239842951529612181041668437",
"70829799812660724861774414618684652126",
"66452508630603502104485600045000300282",
"142453765488468385279960999136152186954",
"99394050491175099895628554385915650763",
"262114813759691425262759728092587421823",
"65597308325985753576507370616932489401",
"120078525613573943353948800448804355862",
"157958725692649172051674765338126882448"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26622-adb3ca4c",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c",
"function": "tomoyo_write_control"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bfe04c1273d30b866f4c7c238331ed3b08e5824",
"digest": {
"length": 1859.0,
"function_hash": "139944227049634160538707385537674183889"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-26622-e0aafd3c",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c",
"function": "tomoyo_write_control"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6edefe1b6c29a9932f558a898968a9fcbeec5711",
"digest": {
"length": 1859.0,
"function_hash": "139944227049634160538707385537674183889"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-26622-ffc28f11",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "security/tomoyo/common.c",
"function": "tomoyo_write_control"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815",
"digest": {
"length": 1859.0,
"function_hash": "139944227049634160538707385537674183889"
},
"signature_type": "Function"
}
]