CVE-2024-49936
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-49936
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49936.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-49936
- Downstream
- Related
- Published
- 2024-10-21T18:15:15Z
- Modified
- 2025-08-09T20:01:26Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/xen-netback: prevent UAF in xenvifflushhash()
During the listforeachentryrcu iteration call of xenvifflushhash, kfreercu does not exist inside the rcu read critical section, so if kfreercu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free.
Therefore, to solve this, you need to change it to listforeachentrysafe.
- References
-
- https://git.kernel.org/stable/c/0fa5e94a1811d68fbffa0725efe6d4ca62c03d12
- https://git.kernel.org/stable/c/143edf098b80669d05245b2f2367dd156a83a2c5
- https://git.kernel.org/stable/c/54d8639af5568fc41c0e274fc3ec9cf86c59fcbb
- https://git.kernel.org/stable/c/a0465723b8581cad27164c9073fd780904cd22d4
- https://git.kernel.org/stable/c/a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c
- https://git.kernel.org/stable/c/d408889d4b54f5501e4becc4dbbb9065143fbf4e
- https://git.kernel.org/stable/c/efcff6ce7467f01f0753609f420333f3f2ceceda
- https://git.kernel.org/stable/c/3c4423b0c4b98213b3438e15061e1d08220e6982