In the Linux kernel, the following vulnerability has been resolved:
xen: privcmd: Fix possible access to a freed kirqfd instance
Nothing prevents simultaneous ioctl calls to privcmdirqfdassign() and privcmdirqfddeassign(). If that happens, it is possible that a kirqfd created and added to the irqfdslist by privcmdirqfdassign() may get removed by another thread executing privcmdirqfd_deassign(), while the former is still using it after dropping the locks.
This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops.
Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds.
[
{
"id": "CVE-2024-46762-016daf0d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112fd2f02b308564724b8e81006c254d20945c4b",
"digest": {
"line_hashes": [
"96137993833842492690771681821627440889",
"240219500721213329052294543528971470597",
"26347230739480085890049122620562536407",
"77213926055359437193813727079643859918",
"13937542942468708650479141277930907280",
"288282542724980093868957458907341789965",
"295134874113579836192107649978899933404",
"5189591097209504040513526302208841226",
"145663757012680301547003987069694132325",
"13933401522059798088316076383470960671",
"205335393625794217847013010235878356846",
"43329674374574184514757304802229119835",
"188032508039361807018192604848951161369",
"6514471894976878139795514411077056385",
"76051473059952412304455313753385845029",
"203381211149173130784387460844511169230",
"166350127100562003786337451514893924506",
"143118305588996460328202994455948116283",
"243148745573849373167939129845584253608",
"175668432955279305343648625693106276437",
"252373870728412953332996884095455238670"
],
"threshold": 0.9
},
"target": {
"file": "drivers/xen/privcmd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-0e7b1adb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@611ff1b1ae989a7bcce3e2a8e132ee30e968c557",
"digest": {
"length": 275.0,
"function_hash": "10013000051697741555146486338281853491"
},
"target": {
"file": "drivers/xen/privcmd.c",
"function": "irqfd_shutdown"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-226f6f55",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112fd2f02b308564724b8e81006c254d20945c4b",
"digest": {
"length": 275.0,
"function_hash": "10013000051697741555146486338281853491"
},
"target": {
"file": "drivers/xen/privcmd.c",
"function": "irqfd_shutdown"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-566fd028",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@611ff1b1ae989a7bcce3e2a8e132ee30e968c557",
"digest": {
"length": 1359.0,
"function_hash": "238278074846097271078633729280037960837"
},
"target": {
"file": "drivers/xen/privcmd.c",
"function": "privcmd_irqfd_assign"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-93f8a40f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@611ff1b1ae989a7bcce3e2a8e132ee30e968c557",
"digest": {
"line_hashes": [
"96137993833842492690771681821627440889",
"240219500721213329052294543528971470597",
"26347230739480085890049122620562536407",
"77213926055359437193813727079643859918",
"13937542942468708650479141277930907280",
"288282542724980093868957458907341789965",
"295134874113579836192107649978899933404",
"5189591097209504040513526302208841226",
"145663757012680301547003987069694132325",
"13933401522059798088316076383470960671",
"205335393625794217847013010235878356846",
"43329674374574184514757304802229119835",
"188032508039361807018192604848951161369",
"6514471894976878139795514411077056385",
"76051473059952412304455313753385845029",
"203381211149173130784387460844511169230",
"166350127100562003786337451514893924506",
"143118305588996460328202994455948116283",
"243148745573849373167939129845584253608",
"175668432955279305343648625693106276437",
"252373870728412953332996884095455238670"
],
"threshold": 0.9
},
"target": {
"file": "drivers/xen/privcmd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-ad8dc828",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e997b357b13a7d95de31681fc54fcc34235fa527",
"digest": {
"length": 275.0,
"function_hash": "10013000051697741555146486338281853491"
},
"target": {
"file": "drivers/xen/privcmd.c",
"function": "irqfd_shutdown"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-b1add0af",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112fd2f02b308564724b8e81006c254d20945c4b",
"digest": {
"length": 1359.0,
"function_hash": "238278074846097271078633729280037960837"
},
"target": {
"file": "drivers/xen/privcmd.c",
"function": "privcmd_irqfd_assign"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-c6d9dea6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e997b357b13a7d95de31681fc54fcc34235fa527",
"digest": {
"length": 1359.0,
"function_hash": "238278074846097271078633729280037960837"
},
"target": {
"file": "drivers/xen/privcmd.c",
"function": "privcmd_irqfd_assign"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-46762-d7397993",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e997b357b13a7d95de31681fc54fcc34235fa527",
"digest": {
"line_hashes": [
"96137993833842492690771681821627440889",
"240219500721213329052294543528971470597",
"26347230739480085890049122620562536407",
"77213926055359437193813727079643859918",
"7343374885986201842365044166272893873",
"208274322138966851027918857672911990920",
"295134874113579836192107649978899933404",
"5189591097209504040513526302208841226",
"145663757012680301547003987069694132325",
"13933401522059798088316076383470960671",
"205335393625794217847013010235878356846",
"43329674374574184514757304802229119835",
"188032508039361807018192604848951161369",
"6514471894976878139795514411077056385",
"76051473059952412304455313753385845029",
"203381211149173130784387460844511169230",
"166350127100562003786337451514893924506",
"143118305588996460328202994455948116283",
"243148745573849373167939129845584253608",
"175668432955279305343648625693106276437",
"252373870728412953332996884095455238670"
],
"threshold": 0.9
},
"target": {
"file": "drivers/xen/privcmd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
]