CVE-2024-39501

kernel: drivers: core: synchronize really_probe() and dev_uevent()

View on CVE.org
Published Jul 12, 2024 CVSS 3.1 · 4.7 Medium EPSS n/a KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4008-1 linux-6.1 security update
Debian DSA Debian DSA DSA-5730-1 linux security update
Debian DSA Debian DSA DSA-5731-1 linux security update
Ubuntu USN Ubuntu USN USN-6999-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6999-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7003-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7003-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7003-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7003-4 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7003-5 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7004-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7005-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7005-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7006-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7007-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7007-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7007-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7008-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7009-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7009-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7019-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7029-1 Linux kernel vulnerabilities
History
Type Values Removed Values Added
Title drivers: core: synchronize really_probe() and dev_uevent() kernel: drivers: core: synchronize really_probe() and dev_uevent()
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drivers: core: synchronize really_probe() and dev_uevent() Synchronize the dev->driver usage in really_probe() and dev_uevent(). These can run in different threads, what can result in the following race condition for dev->driver uninitialization: Thread #1: ========== really_probe() { ... probe_failed: ... device_unbind_cleanup(dev) { ... dev->driver = NULL; // <= Failed probe sets dev->driver to NULL ... } ... } Thread #2: ========== dev_uevent() { ... if (dev->driver) // If dev->driver is NULLed from really_probe() from here on, // after above check, the system crashes add_uevent_var(env, "DRIVER=%s", dev->driver->name); ... } really_probe() holds the lock, already. So nothing needs to be done there. dev_uevent() is called with lock held, often, too. But not always. What implies that we can't add any locking in dev_uevent() itself. So fix this race by adding the lock to the non-protected path. This is the path where above race is observed: dev_uevent+0x235/0x380 uevent_show+0x10c/0x1f0 <= Add lock here dev_attr_show+0x3a/0xa0 sysfs_kf_seq_show+0x17c/0x250 kernfs_seq_show+0x7c/0x90 seq_read_iter+0x2d7/0x940 kernfs_fop_read_iter+0xc6/0x310 vfs_read+0x5bc/0x6b0 ksys_read+0xeb/0x1b0 __x64_sys_read+0x42/0x50 x64_sys_call+0x27ad/0x2d30 do_syscall_64+0xcd/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Similar cases are reported by syzkaller in https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a But these are regarding the *initialization* of dev->driver dev->driver = drv; As this switches dev->driver to non-NULL these reports can be considered to be false-positives (which should be "fixed" by this commit, as well, though). The same issue was reported and tried to be fixed back in 2015 in https://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/ already. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9
Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8::nfv
Vendors & Products Redhat
Redhat enterprise Linux
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Earlier changes (5)
Weaknesses

Sources

Status
REJECTED
Assigner
Linux
Published
Updated
May 10, 2025, 2:14 PM
Reserved
Jun 25, 2024, 2:23 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Jul 12, 2024, 1:15 PM
Modified
Oct 16, 2026, 1:10 PM

View source JSON

Severity
Moderate
Public date
Jul 12, 2024, 12:00 AM

View source Bugzilla JSON

No data.