CVE-2024-40947

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40947", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.589Z", "datePublished": "2024-07-12T12:31:52.810Z", "dateUpdated": "2026-08-05T11:34:10.711Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:10.711Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Avoid blocking in RCU read-side critical section\n\nA panic happens in ima_match_policy:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nPGD 42f873067 P4D 0\nOops: 0000 [#1] SMP NOPTI\nCPU: 5 PID: 1286325 Comm: kubeletmonit.sh\nKdump: loaded Tainted: P\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n BIOS 0.0.0 02/06/2015\nRIP: 0010:ima_match_policy+0x84/0x450\nCode: 49 89 fc 41 89 cf 31 ed 89 44 24 14 eb 1c 44 39\n 7b 18 74 26 41 83 ff 05 74 20 48 8b 1b 48 3b 1d\n f2 b9 f4 00 0f 84 9c 01 00 00 <44> 85 73 10 74 ea\n 44 8b 6b 14 41 f6 c5 01 75 d4 41 f6 c5 02 74 0f\nRSP: 0018:ff71570009e07a80 EFLAGS: 00010207\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000200\nRDX: ffffffffad8dc7c0 RSI: 0000000024924925 RDI: ff3e27850dea2000\nRBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffabfce739\nR10: ff3e27810cc42400 R11: 0000000000000000 R12: ff3e2781825ef970\nR13: 00000000ff3e2785 R14: 000000000000000c R15: 0000000000000001\nFS: 00007f5195b51740(0000)\nGS:ff3e278b12d40000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000010 CR3: 0000000626d24002 CR4: 0000000000361ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ima_get_action+0x22/0x30\n process_measurement+0xb0/0x830\n ? page_add_file_rmap+0x15/0x170\n ? alloc_set_pte+0x269/0x4c0\n ? prep_new_page+0x81/0x140\n ? simple_xattr_get+0x75/0xa0\n ? selinux_file_open+0x9d/0xf0\n ima_file_check+0x64/0x90\n path_openat+0x571/0x1720\n do_filp_open+0x9b/0x110\n ? page_counter_try_charge+0x57/0xc0\n ? files_cgroup_alloc_fd+0x38/0x60\n ? __alloc_fd+0xd4/0x250\n ? do_sys_open+0x1bd/0x250\n do_sys_open+0x1bd/0x250\n do_syscall_64+0x5d/0x1d0\n entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nCommit c7423dbdbc9e (\"ima: Handle -ESTALE returned by\nima_filter_rule_match()\") introduced call to ima_lsm_copy_rule within a\nRCU read-side critical section which contains kmalloc with GFP_KERNEL.\nThis implies a possible sleep and violates limitations of RCU read-side\ncritical sections on non-PREEMPT systems.\n\nSleeping within RCU read-side critical section might cause\nsynchronize_rcu() returning early and break RCU protection, allowing a\nUAF to happen.\n\nThe root cause of this issue could be described as follows:\n|\tThread A\t|\tThread B\t|\n|\t\t\t|ima_match_policy\t|\n|\t\t\t| rcu_read_lock\t|\n|ima_lsm_update_rule\t|\t\t\t|\n| synchronize_rcu\t|\t\t\t|\n|\t\t\t| kmalloc(GFP_KERNEL)|\n|\t\t\t| sleep\t\t|\n==> synchronize_rcu returns early\n| kfree(entry)\t\t|\t\t\t|\n|\t\t\t| entry = entry->next|\n==> UAF happens and entry now becomes NULL (or could be anything).\n|\t\t\t| entry->action\t|\n==> Accessing entry might cause panic.\n\nTo fix this issue, we are converting all kmalloc that is called within\nRCU read-side critical section to use GFP_ATOMIC.\n\n[PM: fixed missing comment, long lines, !CONFIG_IMA_LSM_RULES case]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable RCU read-side section is entered from `ima_file_check()`/`process_measurement()` on the `open()`/`execve()` path, so the attacker must be executing code locally on the host. There is no network protocol handler that reaches `ima_match_policy()` directly.\nAC:L - The attacker fully controls the reader side (an `open()` storm across all CPUs), the memory pressure that forces the `GFP_KERNEL` allocation into reclaim and schedules away, and the parallelism \u2014 no specific memory layout or timing the attacker cannot influence is needed, and `ima_lsm_update_rules()` performs a separate `synchronize_rcu()` for every LSM rule, leaving a wide window. The one precondition outside attacker control is a concurrent SELinux policy reload/`setsebool`, a routine administrative event the attacker can simply hold a persistent trigger loop through (and can even detect via the unprivileged-readable selinuxfs status page).\nPR:L - Reaching `ima_match_policy()` requires only the ability to open files as an ordinary unprivileged local user; there is no capability check anywhere on the `path_openat \u2192 ima_file_check \u2192 ima_match_policy` path. No root or CAP_MAC_ADMIN is needed on the attacker's side.\nUI:N - The race is hit entirely by the attacker's own threads sleeping inside the RCU read-side critical section; no victim has to open a file, mount a filesystem, or perform any action for the UAF to occur.\nS:U - The freed `ima_rule_entry` and all resulting corruption are within the host kernel's own security authority. This is standard in-kernel memory corruption with no VM, IOMMU, or sandbox boundary crossed.\nC:H - After the early `synchronize_rcu()` return, the reader dereferences the freed rule's `list.next`, `fsname` (passed to `strcmp()`), and `template` pointers, so a heap spray of the reallocated `ima_rule_entry` yields attacker-directed kernel reads. Per kernel scoring guidance, a use-after-free is treated as High confidentiality impact.\nI:H - `struct ima_rule_entry` holds four function pointers (`uid_op`, `gid_op`, `fowner_op`, `fgroup_op`) that `ima_match_rules()` calls directly, plus `template`, whose `fields[i]->field_init()` is invoked in `ima_api.c` \u2014 controlling the reallocated object gives control-flow hijack. The attacker can also forge `entry->action`/`entry->flags` to suppress IMA measurement and appraisal, defeating the integrity subsystem itself.\nA:H - The reported real-world symptom is a kernel NULL-pointer dereference and panic in `ima_match_policy+0x84/0x450` reached from `do_sys_open()`. Any use-after-free of this kind reliably oopses or panics the machine even when not exploited further."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/lsm_hook_defs.h", "include/linux/security.h", "kernel/auditfilter.c", "security/apparmor/audit.c", "security/apparmor/include/audit.h", "security/integrity/ima/ima.h", "security/integrity/ima/ima_policy.c", "security/security.c", "security/selinux/include/audit.h", "security/selinux/ss/services.c", "security/smack/smack_lsm.c"], "versions": [{"version": "c4b035b1f036ddd53fbfced49046e586c5ad8a3e", "lessThan": "a6176a802c4bfb83bf7524591aa75f44a639a853", "status": "affected", "versionType": "git"}, {"version": "2d4bc60693c4206c64723e94ae5f7a04c0b8f18f", "lessThan": "a38e02265c681b51997a264aaf743095e2ee400a", "status": "affected", "versionType": "git"}, {"version": "8008f1691c15f353f5a53dc5d450b8262cb57421", "lessThan": "9c3906c3738562b1fedc6f1cfc81756a7cfefff0", "status": "affected", "versionType": "git"}, {"version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "lessThan": "28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88", "status": "affected", "versionType": "git"}, {"version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "lessThan": "58275455893066149e9f4df2223ab2fdbdc59f9c", "status": "affected", "versionType": "git"}, {"version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "lessThan": "9a95c5bfbf02a0a7f5983280fe284a0ff0836c34", "status": "affected", "versionType": "git"}, {"version": "38d48fd224036717fcb3437e7af1314f6ebcd2d0", "status": "affected", "versionType": "git"}, {"version": "69c60b2a2dbb4887739d3a13297cc0dae3793f35", "status": "affected", "versionType": "git"}, {"version": "5.10.163", "lessThan": "5.10.222", "status": "affected", "versionType": "semver"}, {"version": "5.15.86", "lessThan": "5.15.163", "status": "affected", "versionType": "semver"}, {"version": "6.1.2", "lessThan": "6.1.98", "status": "affected", "versionType": "semver"}, {"version": "5.4.229", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "6.0.16", "lessThan": "6.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/lsm_hook_defs.h", "include/linux/security.h", "kernel/auditfilter.c", "security/apparmor/audit.c", "security/apparmor/include/audit.h", "security/integrity/ima/ima.h", "security/integrity/ima/ima_policy.c", "security/security.c", "security/selinux/include/audit.h", "security/selinux/ss/services.c", "security/smack/smack_lsm.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.98", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.39", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.163", "versionEndExcluding": "5.10.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.86", "versionEndExcluding": "5.15.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.2", "versionEndExcluding": "6.1.98"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.9.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.229"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a6176a802c4bfb83bf7524591aa75f44a639a853"}, {"url": "https://git.kernel.org/stable/c/a38e02265c681b51997a264aaf743095e2ee400a"}, {"url": "https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0"}, {"url": "https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88"}, {"url": "https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9c"}, {"url": "https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34"}], "title": "ima: Avoid blocking in RCU read-side critical section", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a6176a802c4bfb83bf7524591aa75f44a639a853", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a38e02265c681b51997a264aaf743095e2ee400a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:58:14.185Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:04:11.306292Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:25.214Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a6176a802c4bfb83bf7524591aa75f44a639a853", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a38e02265c681b51997a264aaf743095e2ee400a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:58:14.185Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:04:11.306292Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.527Z"}}], "cna": {"title": "ima: Avoid blocking in RCU read-side critical section", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c4b035b1f036ddd53fbfced49046e586c5ad8a3e", "lessThan": "a6176a802c4bfb83bf7524591aa75f44a639a853", "versionType": "git"}, {"status": "affected", "version": "2d4bc60693c4206c64723e94ae5f7a04c0b8f18f", "lessThan": "a38e02265c681b51997a264aaf743095e2ee400a", "versionType": "git"}, {"status": "affected", "version": "8008f1691c15f353f5a53dc5d450b8262cb57421", "lessThan": "9c3906c3738562b1fedc6f1cfc81756a7cfefff0", "versionType": "git"}, {"status": "affected", "version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "lessThan": "28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88", "versionType": "git"}, {"status": "affected", "version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "lessThan": "58275455893066149e9f4df2223ab2fdbdc59f9c", "versionType": "git"}, {"status": "affected", "version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "lessThan": "9a95c5bfbf02a0a7f5983280fe284a0ff0836c34", "versionType": "git"}, {"status": "affected", "version": "38d48fd224036717fcb3437e7af1314f6ebcd2d0", "versionType": "git"}, {"status": "affected", "version": "69c60b2a2dbb4887739d3a13297cc0dae3793f35", "versionType": "git"}, {"status": "affected", "version": "5.10.163", "lessThan": "5.10.222", "versionType": "semver"}, {"status": "affected", "version": "5.15.86", "lessThan": "5.15.163", "versionType": "semver"}, {"status": "affected", "version": "6.1.2", "lessThan": "6.1.98", "versionType": "semver"}, {"status": "affected", "version": "5.4.229", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "6.0.16", "lessThan": "6.1", "versionType": "semver"}], "programFiles": ["include/linux/lsm_hook_defs.h", "include/linux/security.h", "kernel/auditfilter.c", "security/apparmor/audit.c", "security/apparmor/include/audit.h", "security/integrity/ima/ima.h", "security/integrity/ima/ima_policy.c", "security/security.c", "security/selinux/include/audit.h", "security/selinux/ss/services.c", "security/smack/smack_lsm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.222", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.163", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.98", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.39", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.7", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/lsm_hook_defs.h", "include/linux/security.h", "kernel/auditfilter.c", "security/apparmor/audit.c", "security/apparmor/include/audit.h", "security/integrity/ima/ima.h", "security/integrity/ima/ima_policy.c", "security/security.c", "security/selinux/include/audit.h", "security/selinux/ss/services.c", "security/smack/smack_lsm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a6176a802c4bfb83bf7524591aa75f44a639a853"}, {"url": "https://git.kernel.org/stable/c/a38e02265c681b51997a264aaf743095e2ee400a"}, {"url": "https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0"}, {"url": "https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88"}, {"url": "https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9c"}, {"url": "https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Avoid blocking in RCU read-side critical section\n\nA panic happens in ima_match_policy:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nPGD 42f873067 P4D 0\nOops: 0000 [#1] SMP NOPTI\nCPU: 5 PID: 1286325 Comm: kubeletmonit.sh\nKdump: loaded Tainted: P\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n BIOS 0.0.0 02/06/2015\nRIP: 0010:ima_match_policy+0x84/0x450\nCode: 49 89 fc 41 89 cf 31 ed 89 44 24 14 eb 1c 44 39\n 7b 18 74 26 41 83 ff 05 74 20 48 8b 1b 48 3b 1d\n f2 b9 f4 00 0f 84 9c 01 00 00 <44> 85 73 10 74 ea\n 44 8b 6b 14 41 f6 c5 01 75 d4 41 f6 c5 02 74 0f\nRSP: 0018:ff71570009e07a80 EFLAGS: 00010207\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000200\nRDX: ffffffffad8dc7c0 RSI: 0000000024924925 RDI: ff3e27850dea2000\nRBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffabfce739\nR10: ff3e27810cc42400 R11: 0000000000000000 R12: ff3e2781825ef970\nR13: 00000000ff3e2785 R14: 000000000000000c R15: 0000000000000001\nFS: 00007f5195b51740(0000)\nGS:ff3e278b12d40000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000010 CR3: 0000000626d24002 CR4: 0000000000361ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ima_get_action+0x22/0x30\n process_measurement+0xb0/0x830\n ? page_add_file_rmap+0x15/0x170\n ? alloc_set_pte+0x269/0x4c0\n ? prep_new_page+0x81/0x140\n ? simple_xattr_get+0x75/0xa0\n ? selinux_file_open+0x9d/0xf0\n ima_file_check+0x64/0x90\n path_openat+0x571/0x1720\n do_filp_open+0x9b/0x110\n ? page_counter_try_charge+0x57/0xc0\n ? files_cgroup_alloc_fd+0x38/0x60\n ? __alloc_fd+0xd4/0x250\n ? do_sys_open+0x1bd/0x250\n do_sys_open+0x1bd/0x250\n do_syscall_64+0x5d/0x1d0\n entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nCommit c7423dbdbc9e (\"ima: Handle -ESTALE returned by\nima_filter_rule_match()\") introduced call to ima_lsm_copy_rule within a\nRCU read-side critical section which contains kmalloc with GFP_KERNEL.\nThis implies a possible sleep and violates limitations of RCU read-side\ncritical sections on non-PREEMPT systems.\n\nSleeping within RCU read-side critical section might cause\nsynchronize_rcu() returning early and break RCU protection, allowing a\nUAF to happen.\n\nThe root cause of this issue could be described as follows:\n|\tThread A\t|\tThread B\t|\n|\t\t\t|ima_match_policy\t|\n|\t\t\t| rcu_read_lock\t|\n|ima_lsm_update_rule\t|\t\t\t|\n| synchronize_rcu\t|\t\t\t|\n|\t\t\t| kmalloc(GFP_KERNEL)|\n|\t\t\t| sleep\t\t|\n==> synchronize_rcu returns early\n| kfree(entry)\t\t|\t\t\t|\n|\t\t\t| entry = entry->next|\n==> UAF happens and entry now becomes NULL (or could be anything).\n|\t\t\t| entry->action\t|\n==> Accessing entry might cause panic.\n\nTo fix this issue, we are converting all kmalloc that is called within\nRCU read-side critical section to use GFP_ATOMIC.\n\n[PM: fixed missing comment, long lines, !CONFIG_IMA_LSM_RULES case]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.222", "versionStartIncluding": "5.10.163"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.15.86"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.98", "versionStartIncluding": "6.1.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.39", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.229"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.0.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:51:10.874Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40947", "state": "PUBLISHED", "dateUpdated": "2026-05-23T15:51:10.874Z", "dateReserved": "2024-07-12T12:17:45.589Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:31:52.810Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/lsm_hook_defs.h", "include/linux/security.h", "kernel/auditfilter.c", "security/apparmor/audit.c", "security/apparmor/include/audit.h", "security/integrity/ima/ima.h", "security/integrity/ima/ima_policy.c", "security/security.c", "security/selinux/include/audit.h", "security/selinux/ss/services.c", "security/smack/smack_lsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a6176a802c4bfb83bf7524591aa75f44a639a853", "status": "affected", "version": "c4b035b1f036ddd53fbfced49046e586c5ad8a3e", "versionType": "git"}, {"lessThan": "a38e02265c681b51997a264aaf743095e2ee400a", "status": "affected", "version": "2d4bc60693c4206c64723e94ae5f7a04c0b8f18f", "versionType": "git"}, {"lessThan": "9c3906c3738562b1fedc6f1cfc81756a7cfefff0", "status": "affected", "version": "8008f1691c15f353f5a53dc5d450b8262cb57421", "versionType": "git"}, {"lessThan": "28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88", "status": "affected", "version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "versionType": "git"}, {"lessThan": "58275455893066149e9f4df2223ab2fdbdc59f9c", "status": "affected", "version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "versionType": "git"}, {"lessThan": "9a95c5bfbf02a0a7f5983280fe284a0ff0836c34", "status": "affected", "version": "c7423dbdbc9ecef7fff5239d144cad4b9887f4de", "versionType": "git"}, {"status": "affected", "version": "38d48fd224036717fcb3437e7af1314f6ebcd2d0", "versionType": "git"}, {"status": "affected", "version": "69c60b2a2dbb4887739d3a13297cc0dae3793f35", "versionType": "git"}, {"lessThan": "5.10.222", "status": "affected", "version": "5.10.163", "versionType": "semver"}, {"lessThan": "5.15.163", "status": "affected", "version": "5.15.86", "versionType": "semver"}, {"lessThan": "6.1.98", "status": "affected", "version": "6.1.2", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.229", "versionType": "semver"}, {"lessThan": "6.1", "status": "affected", "version": "6.0.16", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/lsm_hook_defs.h", "include/linux/security.h", "kernel/auditfilter.c", "security/apparmor/audit.c", "security/apparmor/include/audit.h", "security/integrity/ima/ima.h", "security/integrity/ima/ima_policy.c", "security/security.c", "security/selinux/include/audit.h", "security/selinux/ss/services.c", "security/smack/smack_lsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.222", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.163", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.98", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.39", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "591759E0-9179-476B-B922-DD6AA7773219", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.229", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "529FF495-B667-4E6E-ACB5-8FBCB9BE8704", "versionEndExcluding": "5.10.222", "versionStartIncluding": "5.10.163", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "923691DD-6269-4C2F-AD6B-A27632B981E7", "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.15.86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C7522E3-150F-436D-BBD7-96C7B4B795ED", "versionEndExcluding": "6.1", "versionStartIncluding": "6.0.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA2EC548-B702-4EBB-B7D0-3FD41434B72C", "versionEndExcluding": "6.1.98", "versionStartIncluding": "6.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "29E894E4-668F-4DB0-81F7-4FB5F698E970", "versionEndExcluding": "6.6.39", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C", "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Avoid blocking in RCU read-side critical section\n\nA panic happens in ima_match_policy:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nPGD 42f873067 P4D 0\nOops: 0000 [#1] SMP NOPTI\nCPU: 5 PID: 1286325 Comm: kubeletmonit.sh\nKdump: loaded Tainted: P\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n BIOS 0.0.0 02/06/2015\nRIP: 0010:ima_match_policy+0x84/0x450\nCode: 49 89 fc 41 89 cf 31 ed 89 44 24 14 eb 1c 44 39\n 7b 18 74 26 41 83 ff 05 74 20 48 8b 1b 48 3b 1d\n f2 b9 f4 00 0f 84 9c 01 00 00 <44> 85 73 10 74 ea\n 44 8b 6b 14 41 f6 c5 01 75 d4 41 f6 c5 02 74 0f\nRSP: 0018:ff71570009e07a80 EFLAGS: 00010207\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000200\nRDX: ffffffffad8dc7c0 RSI: 0000000024924925 RDI: ff3e27850dea2000\nRBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffabfce739\nR10: ff3e27810cc42400 R11: 0000000000000000 R12: ff3e2781825ef970\nR13: 00000000ff3e2785 R14: 000000000000000c R15: 0000000000000001\nFS: 00007f5195b51740(0000)\nGS:ff3e278b12d40000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000010 CR3: 0000000626d24002 CR4: 0000000000361ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ima_get_action+0x22/0x30\n process_measurement+0xb0/0x830\n ? page_add_file_rmap+0x15/0x170\n ? alloc_set_pte+0x269/0x4c0\n ? prep_new_page+0x81/0x140\n ? simple_xattr_get+0x75/0xa0\n ? selinux_file_open+0x9d/0xf0\n ima_file_check+0x64/0x90\n path_openat+0x571/0x1720\n do_filp_open+0x9b/0x110\n ? page_counter_try_charge+0x57/0xc0\n ? files_cgroup_alloc_fd+0x38/0x60\n ? __alloc_fd+0xd4/0x250\n ? do_sys_open+0x1bd/0x250\n do_sys_open+0x1bd/0x250\n do_syscall_64+0x5d/0x1d0\n entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nCommit c7423dbdbc9e (\"ima: Handle -ESTALE returned by\nima_filter_rule_match()\") introduced call to ima_lsm_copy_rule within a\nRCU read-side critical section which contains kmalloc with GFP_KERNEL.\nThis implies a possible sleep and violates limitations of RCU read-side\ncritical sections on non-PREEMPT systems.\n\nSleeping within RCU read-side critical section might cause\nsynchronize_rcu() returning early and break RCU protection, allowing a\nUAF to happen.\n\nThe root cause of this issue could be described as follows:\n|\tThread A\t|\tThread B\t|\n|\t\t\t|ima_match_policy\t|\n|\t\t\t| rcu_read_lock\t|\n|ima_lsm_update_rule\t|\t\t\t|\n| synchronize_rcu\t|\t\t\t|\n|\t\t\t| kmalloc(GFP_KERNEL)|\n|\t\t\t| sleep\t\t|\n==> synchronize_rcu returns early\n| kfree(entry)\t\t|\t\t\t|\n|\t\t\t| entry = entry->next|\n==> UAF happens and entry now becomes NULL (or could be anything).\n|\t\t\t| entry->action\t|\n==> Accessing entry might cause panic.\n\nTo fix this issue, we are converting all kmalloc that is called within\nRCU read-side critical section to use GFP_ATOMIC.\n\n[PM: fixed missing comment, long lines, !CONFIG_IMA_LSM_RULES case]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ima: Evite el bloqueo en la secci\u00f3n cr\u00edtica del lado de lectura de RCU Ocurre un p\u00e1nico en ima_match_policy: ERROR: no se puede manejar la desreferencia del puntero NULL del kernel en 00000000000000010 PGD 42f873067 P4D 0 Ups: 0000 [#1 ] SMP NOPTI CPU: 5 PID: 1286325 Comm: kubeletmonit.sh Kdump: cargado Contaminado: P Nombre del hardware: QEMU PC est\u00e1ndar (i440FX + PIIX, 1996), BIOS 0.0.0 06/02/2015 RIP: 0010:ima_match_policy+0x84 /0x450 C\u00f3digo: 49 89 fc 41 89 cf 31 ed 89 44 24 14 eb 1c 44 39 7b 18 74 26 41 83 ff 05 74 20 48 8b 1b 48 3b 1d f2 b9 f4 00 0f 84 9c 01 00 &lt;44&gt; 85 73 10 74 ea 44 8b 6b 14 41 f6 c5 01 75 d4 41 f6 c5 02 74 0f RSP: 0018:ff71570009e07a80 EFLAGS: 00010207 RAX: 0000000000000000 RBX: 0000000000 RCX: 0000000000000200 RDX: ffffffffad8dc7c0 RSI: 0000000024924925 RDI: ff3e27850dea2000 RBP: 0000000000000000 R08 : 0000000000000000 R09: ffffffffabfce739 R10: ff3e27810cc42400 R11: 0000000000000000 R12: ff3e2781825ef970 R13: 00000000ff3e2785 R14: 000000000c R15: 0000000000000001 FS: 00007f5195b51740(0000) GS:ff3e278b12d40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: : 0000000080050033 CR2: 0000000000000010 CR3: 0000000626d24002 CR4: 0000000000361ee0 DR0: 0000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas: ima_get_action+0x22/0x30 Process_measurement+0xb0/0x830 ? page_add_file_rmap+0x15/0x170? alloc_set_pte+0x269/0x4c0? prep_new_page+0x81/0x140? simple_xattr_get+0x75/0xa0? selinux_file_open+0x9d/0xf0 ima_file_check+0x64/0x90 path_openat+0x571/0x1720 do_filp_open+0x9b/0x110 ? page_counter_try_charge+0x57/0xc0? files_cgroup_alloc_fd+0x38/0x60? __alloc_fd+0xd4/0x250? do_sys_open+0x1bd/0x250 do_sys_open+0x1bd/0x250 do_syscall_64+0x5d/0x1d0 Entry_SYSCALL_64_after_hwframe+0x65/0xca Commit c7423dbdbc9e (\"ima: Handle -ESTALE devuelto por ima_filter_rule_match()\") introdujo la llamada a ima_lsm _copy_rule dentro de una secci\u00f3n cr\u00edtica del lado de lectura de RCU que contiene kmalloc con GFP_KERNEL. Esto implica una posible suspensi\u00f3n y viola las limitaciones de las secciones cr\u00edticas del lado de lectura de RCU en sistemas que no son PREEMPT. Dormir dentro de la secci\u00f3n cr\u00edtica del lado de lectura de la RCU puede provocar que sincronizar_rcu() regrese antes de tiempo y rompa la protecci\u00f3n de la RCU, lo que permite que se produzca una UAF. La causa ra\u00edz de este problema podr\u00eda describirse de la siguiente manera: | Hilo A | Hilo B | | |ima_match_policy | | | rcu_read_lock | |ima_lsm_update_rule | | | sincronizar_rcu | | | | kmalloc(GFP_KERNEL)| | | dormir | ==&gt; sincronizar_rcu regresa temprano | kfree(entrada) | | | | entrada = entrada-&gt;siguiente| ==&gt; Sucede UAF y la entrada ahora se vuelve NULL (o podr\u00eda ser cualquier cosa). | | entrada-&gt;acci\u00f3n | ==&gt; Acceder a la entrada puede causar p\u00e1nico. Para solucionar este problema, estamos convirtiendo todos los kmalloc que se llaman dentro de la secci\u00f3n cr\u00edtica del lado de lectura de RCU para usar GFP_ATOMIC. [PM: comentario faltante corregido, l\u00edneas largas, caso !CONFIG_IMA_LSM_RULES]"}], "id": "CVE-2024-40947", "lastModified": "2026-08-04T11:19:08.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40947", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:04:11.306292Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:17.073", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a38e02265c681b51997a264aaf743095e2ee400a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6176a802c4bfb83bf7524591aa75f44a639a853"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a38e02265c681b51997a264aaf743095e2ee400a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6176a802c4bfb83bf7524591aa75f44a639a853"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ima: Avoid blocking in RCU read-side critical section", "id": "2297531", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297531"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-362->CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nima: Avoid blocking in RCU read-side critical section\nA panic happens in ima_match_policy:\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nPGD 42f873067 P4D 0\nOops: 0000 [#1] SMP NOPTI\nCPU: 5 PID: 1286325 Comm: kubeletmonit.sh\nKdump: loaded Tainted: P\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS 0.0.0 02/06/2015\nRIP: 0010:ima_match_policy+0x84/0x450\nCode: 49 89 fc 41 89 cf 31 ed 89 44 24 14 eb 1c 44 39\n7b 18 74 26 41 83 ff 05 74 20 48 8b 1b 48 3b 1d\nf2 b9 f4 00 0f 84 9c 01 00 00 <44> 85 73 10 74 ea\n44 8b 6b 14 41 f6 c5 01 75 d4 41 f6 c5 02 74 0f\nRSP: 0018:ff71570009e07a80 EFLAGS: 00010207\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000200\nRDX: ffffffffad8dc7c0 RSI: 0000000024924925 RDI: ff3e27850dea2000\nRBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffabfce739\nR10: ff3e27810cc42400 R11: 0000000000000000 R12: ff3e2781825ef970\nR13: 00000000ff3e2785 R14: 000000000000000c R15: 0000000000000001\nFS: 00007f5195b51740(0000)\nGS:ff3e278b12d40000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000010 CR3: 0000000626d24002 CR4: 0000000000361ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\nima_get_action+0x22/0x30\nprocess_measurement+0xb0/0x830\n? page_add_file_rmap+0x15/0x170\n? alloc_set_pte+0x269/0x4c0\n? prep_new_page+0x81/0x140\n? simple_xattr_get+0x75/0xa0\n? selinux_file_open+0x9d/0xf0\nima_file_check+0x64/0x90\npath_openat+0x571/0x1720\ndo_filp_open+0x9b/0x110\n? page_counter_try_charge+0x57/0xc0\n? files_cgroup_alloc_fd+0x38/0x60\n? __alloc_fd+0xd4/0x250\n? do_sys_open+0x1bd/0x250\ndo_sys_open+0x1bd/0x250\ndo_syscall_64+0x5d/0x1d0\nentry_SYSCALL_64_after_hwframe+0x65/0xca\nCommit c7423dbdbc9e (\"ima: Handle -ESTALE returned by\nima_filter_rule_match()\") introduced call to ima_lsm_copy_rule within a\nRCU read-side critical section which contains kmalloc with GFP_KERNEL.\nThis implies a possible sleep and violates limitations of RCU read-side\ncritical sections on non-PREEMPT systems.\nSleeping within RCU read-side critical section might cause\nsynchronize_rcu() returning early and break RCU protection, allowing a\nUAF to happen.\nThe root cause of this issue could be described as follows:\n|Thread A|Thread B|\n||ima_match_policy|\n|| rcu_read_lock|\n|ima_lsm_update_rule||\n| synchronize_rcu||\n|| kmalloc(GFP_KERNEL)|\n|| sleep|\n==> synchronize_rcu returns early\n| kfree(entry)||\n|| entry = entry->next|\n==> UAF happens and entry now becomes NULL (or could be anything).\n|| entry->action|\n==> Accessing entry might cause panic.\nTo fix this issue, we are converting all kmalloc that is called within\nRCU read-side critical section to use GFP_ATOMIC.\n[PM: fixed missing comment, long lines, !CONFIG_IMA_LSM_RULES case]"], "name": "CVE-2024-40947", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40947\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40947\nhttps://lore.kernel.org/linux-cve-announce/2024071221-CVE-2024-40947-4782@gregkh/T"], "threat_severity": "Low"}

{}