In the Linux kernel, the following vulnerability has been resolved:
epoll: be better about file lifetimes
epoll can call out to vfspoll() with a file pointer that may race with the last 'fput()'. That would make fcount go down to zero, and while the ep->mtx locking means that the resulting file pointer tear-down will be blocked until the poll returns, it means that f_count is already dead, and any use of it won't actually get a reference to the file any more: it's dead regardless.
Make sure we have a valid ref on the file pointer before we call down to vfs_poll() from the epoll routines.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "66357036715712704104066001615298050625", "192185559481281024280122472955801694800", "119589814112343664585038330785791201389", "270903479277510424459861752272184200672", "50827734551449565320827701445030945453", "273927472169785357466719689293086787174", "151474035289986395749740053804252564592", "218105048992267085842276474478609821053", "83215756528568642507372353066802380652", "272711597602043820700392117225856663854", "321507596468980540390832652501213523315", "338742124521241774796594961840613283647", "335640784889781498418423649288024908984" ] }, "deprecated": false, "id": "CVE-2024-38580-4220a777", "target": { "file": "fs/eventpoll.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbfd1088e24ec4c1199756a37cb8e4cd0a4b016e" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "66357036715712704104066001615298050625", "192185559481281024280122472955801694800", "119589814112343664585038330785791201389", "270903479277510424459861752272184200672", "50827734551449565320827701445030945453", "273927472169785357466719689293086787174", "151474035289986395749740053804252564592", "218105048992267085842276474478609821053", "83215756528568642507372353066802380652", "272711597602043820700392117225856663854", "321507596468980540390832652501213523315", "338742124521241774796594961840613283647", "335640784889781498418423649288024908984" ] }, "deprecated": false, "id": "CVE-2024-38580-83003eda", "target": { "file": "fs/eventpoll.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4efaa5acf0a1d2b5947f98abb3acf8bfd966422b" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "66357036715712704104066001615298050625", "192185559481281024280122472955801694800", "119589814112343664585038330785791201389", "270903479277510424459861752272184200672", "50827734551449565320827701445030945453", "273927472169785357466719689293086787174", "151474035289986395749740053804252564592", "218105048992267085842276474478609821053", "83215756528568642507372353066802380652", "272711597602043820700392117225856663854", "321507596468980540390832652501213523315", "338742124521241774796594961840613283647", "335640784889781498418423649288024908984" ] }, "deprecated": false, "id": "CVE-2024-38580-86edf0e1", "target": { "file": "fs/eventpoll.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16e3182f6322575eb7c12e728ad3c7986a189d5d" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "66357036715712704104066001615298050625", "192185559481281024280122472955801694800", "119589814112343664585038330785791201389", "270903479277510424459861752272184200672", "50827734551449565320827701445030945453", "273927472169785357466719689293086787174", "151474035289986395749740053804252564592", "218105048992267085842276474478609821053", "83215756528568642507372353066802380652", "272711597602043820700392117225856663854", "321507596468980540390832652501213523315", "338742124521241774796594961840613283647", "335640784889781498418423649288024908984" ] }, "deprecated": false, "id": "CVE-2024-38580-928128ba", "target": { "file": "fs/eventpoll.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f65f4defe4e23659275ce5153541cd4f76ce2d2" }, { "signature_version": "v1", "digest": { "length": 312.0, "function_hash": "155740810105592487983404958257831640838" }, "deprecated": false, "id": "CVE-2024-38580-980e9b67", "target": { "function": "ep_item_poll", "file": "fs/eventpoll.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbfd1088e24ec4c1199756a37cb8e4cd0a4b016e" }, { "signature_version": "v1", "digest": { "length": 312.0, "function_hash": "155740810105592487983404958257831640838" }, "deprecated": false, "id": "CVE-2024-38580-a044ce8a", "target": { "function": "ep_item_poll", "file": "fs/eventpoll.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@559214eb4e5c3d05e69428af2fae2691ba1eb784" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "66357036715712704104066001615298050625", "192185559481281024280122472955801694800", "119589814112343664585038330785791201389", "270903479277510424459861752272184200672", "50827734551449565320827701445030945453", "273927472169785357466719689293086787174", "151474035289986395749740053804252564592", "218105048992267085842276474478609821053", "83215756528568642507372353066802380652", "272711597602043820700392117225856663854", "321507596468980540390832652501213523315", "338742124521241774796594961840613283647", "335640784889781498418423649288024908984" ] }, "deprecated": false, "id": "CVE-2024-38580-f53ea40a", "target": { "file": "fs/eventpoll.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@559214eb4e5c3d05e69428af2fae2691ba1eb784" }, { "signature_version": "v1", "digest": { "length": 312.0, "function_hash": "155740810105592487983404958257831640838" }, "deprecated": false, "id": "CVE-2024-38580-f9c0c2bf", "target": { "function": "ep_item_poll", "file": "fs/eventpoll.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16e3182f6322575eb7c12e728ad3c7986a189d5d" }, { "signature_version": "v1", "digest": { "length": 312.0, "function_hash": "155740810105592487983404958257831640838" }, "deprecated": false, "id": "CVE-2024-38580-fcf4e84a", "target": { "function": "ep_item_poll", "file": "fs/eventpoll.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4efaa5acf0a1d2b5947f98abb3acf8bfd966422b" }, { "signature_version": "v1", "digest": { "length": 312.0, "function_hash": "155740810105592487983404958257831640838" }, "deprecated": false, "id": "CVE-2024-38580-fd2f429c", "target": { "function": "ep_item_poll", "file": "fs/eventpoll.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f65f4defe4e23659275ce5153541cd4f76ce2d2" } ] }