In the Linux kernel, the following vulnerability has been resolved:
epoll: be better about file lifetimes
epoll can call out to vfspoll() with a file pointer that may race with the last 'fput()'. That would make fcount go down to zero, and while the ep->mtx locking means that the resulting file pointer tear-down will be blocked until the poll returns, it means that f_count is already dead, and any use of it won't actually get a reference to the file any more: it's dead regardless.
Make sure we have a valid ref on the file pointer before we call down to vfs_poll() from the epoll routines.
[
{
"deprecated": false,
"id": "CVE-2024-38580-4220a777",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbfd1088e24ec4c1199756a37cb8e4cd0a4b016e",
"target": {
"file": "fs/eventpoll.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"66357036715712704104066001615298050625",
"192185559481281024280122472955801694800",
"119589814112343664585038330785791201389",
"270903479277510424459861752272184200672",
"50827734551449565320827701445030945453",
"273927472169785357466719689293086787174",
"151474035289986395749740053804252564592",
"218105048992267085842276474478609821053",
"83215756528568642507372353066802380652",
"272711597602043820700392117225856663854",
"321507596468980540390832652501213523315",
"338742124521241774796594961840613283647",
"335640784889781498418423649288024908984"
]
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-83003eda",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4efaa5acf0a1d2b5947f98abb3acf8bfd966422b",
"target": {
"file": "fs/eventpoll.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"66357036715712704104066001615298050625",
"192185559481281024280122472955801694800",
"119589814112343664585038330785791201389",
"270903479277510424459861752272184200672",
"50827734551449565320827701445030945453",
"273927472169785357466719689293086787174",
"151474035289986395749740053804252564592",
"218105048992267085842276474478609821053",
"83215756528568642507372353066802380652",
"272711597602043820700392117225856663854",
"321507596468980540390832652501213523315",
"338742124521241774796594961840613283647",
"335640784889781498418423649288024908984"
]
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-86edf0e1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16e3182f6322575eb7c12e728ad3c7986a189d5d",
"target": {
"file": "fs/eventpoll.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"66357036715712704104066001615298050625",
"192185559481281024280122472955801694800",
"119589814112343664585038330785791201389",
"270903479277510424459861752272184200672",
"50827734551449565320827701445030945453",
"273927472169785357466719689293086787174",
"151474035289986395749740053804252564592",
"218105048992267085842276474478609821053",
"83215756528568642507372353066802380652",
"272711597602043820700392117225856663854",
"321507596468980540390832652501213523315",
"338742124521241774796594961840613283647",
"335640784889781498418423649288024908984"
]
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-928128ba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f65f4defe4e23659275ce5153541cd4f76ce2d2",
"target": {
"file": "fs/eventpoll.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"66357036715712704104066001615298050625",
"192185559481281024280122472955801694800",
"119589814112343664585038330785791201389",
"270903479277510424459861752272184200672",
"50827734551449565320827701445030945453",
"273927472169785357466719689293086787174",
"151474035289986395749740053804252564592",
"218105048992267085842276474478609821053",
"83215756528568642507372353066802380652",
"272711597602043820700392117225856663854",
"321507596468980540390832652501213523315",
"338742124521241774796594961840613283647",
"335640784889781498418423649288024908984"
]
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-980e9b67",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbfd1088e24ec4c1199756a37cb8e4cd0a4b016e",
"target": {
"file": "fs/eventpoll.c",
"function": "ep_item_poll"
},
"digest": {
"function_hash": "155740810105592487983404958257831640838",
"length": 312.0
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-a044ce8a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@559214eb4e5c3d05e69428af2fae2691ba1eb784",
"target": {
"file": "fs/eventpoll.c",
"function": "ep_item_poll"
},
"digest": {
"function_hash": "155740810105592487983404958257831640838",
"length": 312.0
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-f53ea40a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@559214eb4e5c3d05e69428af2fae2691ba1eb784",
"target": {
"file": "fs/eventpoll.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"66357036715712704104066001615298050625",
"192185559481281024280122472955801694800",
"119589814112343664585038330785791201389",
"270903479277510424459861752272184200672",
"50827734551449565320827701445030945453",
"273927472169785357466719689293086787174",
"151474035289986395749740053804252564592",
"218105048992267085842276474478609821053",
"83215756528568642507372353066802380652",
"272711597602043820700392117225856663854",
"321507596468980540390832652501213523315",
"338742124521241774796594961840613283647",
"335640784889781498418423649288024908984"
]
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-f9c0c2bf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16e3182f6322575eb7c12e728ad3c7986a189d5d",
"target": {
"file": "fs/eventpoll.c",
"function": "ep_item_poll"
},
"digest": {
"function_hash": "155740810105592487983404958257831640838",
"length": 312.0
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-fcf4e84a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4efaa5acf0a1d2b5947f98abb3acf8bfd966422b",
"target": {
"file": "fs/eventpoll.c",
"function": "ep_item_poll"
},
"digest": {
"function_hash": "155740810105592487983404958257831640838",
"length": 312.0
}
},
{
"deprecated": false,
"id": "CVE-2024-38580-fd2f429c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f65f4defe4e23659275ce5153541cd4f76ce2d2",
"target": {
"file": "fs/eventpoll.c",
"function": "ep_item_poll"
},
"digest": {
"function_hash": "155740810105592487983404958257831640838",
"length": 312.0
}
}
]