CVE-2024-39494

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-39494", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-25T14:23:23.748Z", "datePublished": "2024-07-12T12:20:30.348Z", "dateUpdated": "2026-08-05T11:33:43.864Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:43.864Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Fix use-after-free on a dentry's dname.name\n\n->d_name.name can change on rename and the earlier value can be freed;\nthere are conditions sufficient to stabilize it (->d_lock on dentry,\n->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,\nrename_lock), but none of those are met at any of the sites. Take a stable\nsnapshot of the name instead."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable sites are reached through `security_file_post_open`/`bprm_check_security`/`mmap_file` from ordinary `open(2)`, `execve(2)` and `mmap(PROT_EXEC)` syscalls, and the racing free comes from a local `rename(2)`; no remote peer data is parsed by the affected code.\nAC:L - The attacker owns both sides of the race \u2014 one thread execs/opens the file to start measurement, another renames it \u2014 and the window is enormous: `ima_collect_measurement()` hashes the entire file between capturing and dereferencing the pointer, and `ima_eventname_init_common()` has a sleeping `kzalloc(GFP_KERNEL)` between its `strlen()` and `memcpy()`, both far exceeding the RCU grace period that `kfree_rcu()` waits for. CONFIG_IMA with a measurement policy is standard on distro, attestation and secure-boot systems, and the sequence can be looped indefinitely.\nPR:L - Any unprivileged local user can trigger it by exec'ing or opening a file it owns (builtin `tcb` policy measures `BPRM_CHECK`/`MMAP_CHECK` for all uids, and tmpfs is only excluded for `FILE_CHECK`) while renaming that file in a directory it controls such as /tmp or $HOME. No capability, root, or user-namespace trick is required.\nUI:N - Both halves of the race are performed by the attacker's own two threads; no victim ever has to open, mount, or execute anything.\nS:U - The stale dereference reads kernel heap memory within the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `external_name` is a plain `GFP_KERNEL_ACCOUNT` kmalloc object that returns to the kmalloc-cg slab and can be reclaimed by attacker-sprayed or sensitive kernel objects, and the `strlen()` over it is unbounded so the read runs past the original allocation into adjacent slab data. Those bytes are copied verbatim into the IMA measurement log exposed via securityfs and sent to remote attestation verifiers, and into audit records \u2014 bulk kernel heap disclosure.\nI:H - Attacker-chosen bytes from the reclaimed object land unescaped in the IMA measurement log (`ima_write_template_field_data()` only rewrites spaces, so injected newlines forge whole entries in the newline-delimited `ascii_runtime_measurements` stream) and are hashed into the TPM PCR, corrupting exactly the attestation and audit evidence IMA exists to produce; per use-after-free scoring, reclaim control over the freed object also supports heap-grooming toward stronger primitives.\nA:H - The unbounded `strlen()`/`memcpy()` over a freed slab object whose page may already have been released can fault on unmapped memory and oops the kernel, and the garbage length also feeds `kzalloc()` and audit-buffer sizing; on KASAN/hardened kernels the use-after-free faults immediately, and the whole sequence is repeatable at will by any local user."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/integrity/ima/ima_api.c", "security/integrity/ima/ima_template_lib.c"], "versions": [{"version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "480afcbeb7aaaa22677d3dd48ec590b441eaac1a", "status": "affected", "versionType": "git"}, {"version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb", "status": "affected", "versionType": "git"}, {"version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "0b31e28fbd773aefb6164687e0767319b8199829", "status": "affected", "versionType": "git"}, {"version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "7fb374981e31c193b1152ed8d3b0a95b671330d4", "status": "affected", "versionType": "git"}, {"version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c", "status": "affected", "versionType": "git"}, {"version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "a78a6f0da57d058e2009e9958fdcef66f165208c", "status": "affected", "versionType": "git"}, {"version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "be84f32bb2c981ca670922e047cdde1488b233de", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/integrity/ima/ima_api.c", "security/integrity/ima/ima_template_lib.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.291", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.97", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.35", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.6", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.4.291"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.235"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.174"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.9.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/480afcbeb7aaaa22677d3dd48ec590b441eaac1a"}, {"url": "https://git.kernel.org/stable/c/edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb"}, {"url": "https://git.kernel.org/stable/c/0b31e28fbd773aefb6164687e0767319b8199829"}, {"url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4"}, {"url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c"}, {"url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c"}, {"url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de"}], "title": "ima: Fix use-after-free on a dentry's dname.name", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:56:11.179Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:07:29.508967Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:39.893Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:15.999Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:07:29.508967Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:25.066Z"}}], "cna": {"title": "ima: Fix use-after-free on a dentry's dname.name", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "480afcbeb7aaaa22677d3dd48ec590b441eaac1a", "versionType": "git"}, {"status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb", "versionType": "git"}, {"status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "0b31e28fbd773aefb6164687e0767319b8199829", "versionType": "git"}, {"status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "7fb374981e31c193b1152ed8d3b0a95b671330d4", "versionType": "git"}, {"status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c", "versionType": "git"}, {"status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "a78a6f0da57d058e2009e9958fdcef66f165208c", "versionType": "git"}, {"status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "lessThan": "be84f32bb2c981ca670922e047cdde1488b233de", "versionType": "git"}], "programFiles": ["security/integrity/ima/ima_api.c", "security/integrity/ima/ima_template_lib.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"status": "unaffected", "version": "0", "lessThan": "3.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.291", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.235", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.174", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.97", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.35", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.6", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["security/integrity/ima/ima_api.c", "security/integrity/ima/ima_template_lib.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/480afcbeb7aaaa22677d3dd48ec590b441eaac1a"}, {"url": "https://git.kernel.org/stable/c/edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb"}, {"url": "https://git.kernel.org/stable/c/0b31e28fbd773aefb6164687e0767319b8199829"}, {"url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4"}, {"url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c"}, {"url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c"}, {"url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Fix use-after-free on a dentry's dname.name\n\n->d_name.name can change on rename and the earlier value can be freed;\nthere are conditions sufficient to stabilize it (->d_lock on dentry,\n->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,\nrename_lock), but none of those are met at any of the sites. Take a stable\nsnapshot of the name instead."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.291", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.235", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.174", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.97", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.35", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.6", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "3.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-21T09:12:47.376Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39494", "state": "PUBLISHED", "dateUpdated": "2025-05-21T09:12:47.376Z", "dateReserved": "2024-06-25T14:23:23.748Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:20:30.348Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/integrity/ima/ima_api.c", "security/integrity/ima/ima_template_lib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "480afcbeb7aaaa22677d3dd48ec590b441eaac1a", "status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "versionType": "git"}, {"lessThan": "edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb", "status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "versionType": "git"}, {"lessThan": "0b31e28fbd773aefb6164687e0767319b8199829", "status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "versionType": "git"}, {"lessThan": "7fb374981e31c193b1152ed8d3b0a95b671330d4", "status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "versionType": "git"}, {"lessThan": "dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c", "status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "versionType": "git"}, {"lessThan": "a78a6f0da57d058e2009e9958fdcef66f165208c", "status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "versionType": "git"}, {"lessThan": "be84f32bb2c981ca670922e047cdde1488b233de", "status": "affected", "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/integrity/ima/ima_api.c", "security/integrity/ima/ima_template_lib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.291", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.235", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.174", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.97", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.35", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C64CC6B0-FEE0-4266-8456-18C5654F672F", "versionEndExcluding": "5.4.291", "versionStartIncluding": "3.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "545121FA-DE31-4154-9446-C2000FB4104D", "versionEndExcluding": "5.10.235", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89", "versionEndExcluding": "5.15.174", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "748B6C4B-1F61-47F9-96CC-8899B8412D84", "versionEndExcluding": "6.1.97", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F019D15-84C0-416B-8C57-7F51B68992F0", "versionEndExcluding": "6.6.35", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975", "versionEndExcluding": "6.9.6", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Fix use-after-free on a dentry's dname.name\n\n->d_name.name can change on rename and the earlier value can be freed;\nthere are conditions sufficient to stabilize it (->d_lock on dentry,\n->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,\nrename_lock), but none of those are met at any of the sites. Take a stable\nsnapshot of the name instead."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ima: corrige el use-after-free en dentry dname.name ->d_name.name puede cambiar al cambiar el nombre y el valor anterior se puede liberar; existen condiciones suficientes para estabilizarlo (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusivo en el inodo del padre, rename_lock), pero ninguna de ellas se cumple en ninguno de los sitios. En su lugar, tome una instant\u00e1nea estable del nombre."}], "id": "CVE-2024-39494", "lastModified": "2026-08-04T11:19:00.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-39494", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:07:29.508967Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:12.113", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0b31e28fbd773aefb6164687e0767319b8199829"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/480afcbeb7aaaa22677d3dd48ec590b441eaac1a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ima: Fix use-after-free on a dentry's dname.name", "id": "2297698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297698"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nima: Fix use-after-free on a dentry's dname.name\n->d_name.name can change on rename and the earlier value can be freed;\nthere are conditions sufficient to stabilize it (->d_lock on dentry,\n->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,\nrename_lock), but none of those are met at any of the sites. Take a stable\nsnapshot of the name instead."], "name": "CVE-2024-39494", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-39494\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-39494\nhttps://lore.kernel.org/linux-cve-announce/2024071259-CVE-2024-39494-119a@gregkh/T"], "threat_severity": "Moderate"}

{}