CVE-2024-56749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-56749", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T11:26:39.759Z", "datePublished": "2024-12-29T11:30:15.127Z", "dateUpdated": "2026-08-05T11:46:21.358Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:21.358Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix dlm_recover_members refcount on error\n\nIf dlm_recover_members() fails we don't drop the references of the\nprevious created root_list that holds and keep all rsbs alive during the\nrecovery. It might be not an unlikely event because ping_members() could\nrun into an -EINTR if another recovery progress was triggered again."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The failing condition is produced by data received over the DLM inter-node protocol (TCP/SCTP 21064) \u2014 `check_rcom_config()` returns -EPROTO based on `rf_lvblen`/`rf_lsflags`/`h_version` fields in a peer's DLM_RCOM_STATUS reply, and recovery itself is driven by remote membership events. No local access to the victim is needed.\nAC:L - A peer that answers the status ping with a mismatched config field deterministically forces `dlm_recover_members()` to return -EPROTO and hit the leaking `goto fail`; no race, no memory-layout grooming, and the leak recurs on every recovery cycle.\nPR:N - DLM lowcomms authenticates nothing by default \u2014 it only maps the source address to a configured nodeid, and the RCOM status reply is consumed before any credential check. A remote peer needs no privileges on the target lockspace to supply the malformed reply.\nUI:N - The recovery path runs autonomously in the dlm_recoverd kernel thread in response to cluster membership events and peer replies; no administrator or user action on the victim node is required.\nS:U - The leaked `dlm_rsb` references and the resulting memory pressure are confined to the kernel of the affected node; no security boundary such as a VM or IOMMU domain is crossed.\nC:N - The defect is a missed reference drop on an error path \u2014 no out-of-bounds read, no uninitialized data, and no kernel address is exposed to the attacker.\nI:N - Nothing is written out of bounds or through a stale pointer; the next `dlm_create_root_list()` rebuilds all list linkage, so no memory corruption or data modification results.\nA:H - Every active RSB is permanently pinned (refcount never reaches zero, so it is never deactivated, tossed, or freed), and each repeatable remote trigger pins the current RSB set, producing unbounded unreclaimable kernel slab growth on a busy GFS2/OCFS2 lockspace leading to memory exhaustion and node-wide denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/dlm/recoverd.c"], "versions": [{"version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "3230718a75a6c30ed60ac920c26be2119fa82b8e", "status": "affected", "versionType": "git"}, {"version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "fb2ec564887af1f365d754f7c306f1b5cd375b5e", "status": "affected", "versionType": "git"}, {"version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "200b977ebbc313a59174ba971006a231b3533dc5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/dlm/recoverd.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.11.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e"}, {"url": "https://git.kernel.org/stable/c/fb2ec564887af1f365d754f7c306f1b5cd375b5e"}, {"url": "https://git.kernel.org/stable/c/200b977ebbc313a59174ba971006a231b3533dc5"}], "title": "dlm: fix dlm_recover_members refcount on error", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:57:31.663502Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:03.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:57:31.663502Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:49:25.928Z"}}], "cna": {"title": "dlm: fix dlm_recover_members refcount on error", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The failing condition is produced by data received over the DLM inter-node protocol (TCP/SCTP 21064) \u2014 `check_rcom_config()` returns -EPROTO based on `rf_lvblen`/`rf_lsflags`/`h_version` fields in a peer's DLM_RCOM_STATUS reply, and recovery itself is driven by remote membership events. No local access to the victim is needed.\nAC:L - A peer that answers the status ping with a mismatched config field deterministically forces `dlm_recover_members()` to return -EPROTO and hit the leaking `goto fail`; no race, no memory-layout grooming, and the leak recurs on every recovery cycle.\nPR:N - DLM lowcomms authenticates nothing by default \u2014 it only maps the source address to a configured nodeid, and the RCOM status reply is consumed before any credential check. A remote peer needs no privileges on the target lockspace to supply the malformed reply.\nUI:N - The recovery path runs autonomously in the dlm_recoverd kernel thread in response to cluster membership events and peer replies; no administrator or user action on the victim node is required.\nS:U - The leaked `dlm_rsb` references and the resulting memory pressure are confined to the kernel of the affected node; no security boundary such as a VM or IOMMU domain is crossed.\nC:N - The defect is a missed reference drop on an error path \u2014 no out-of-bounds read, no uninitialized data, and no kernel address is exposed to the attacker.\nI:N - Nothing is written out of bounds or through a stale pointer; the next `dlm_create_root_list()` rebuilds all list linkage, so no memory corruption or data modification results.\nA:H - Every active RSB is permanently pinned (refcount never reaches zero, so it is never deactivated, tossed, or freed), and each repeatable remote trigger pins the current RSB set, producing unbounded unreclaimable kernel slab growth on a busy GFS2/OCFS2 lockspace leading to memory exhaustion and node-wide denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "3230718a75a6c30ed60ac920c26be2119fa82b8e", "versionType": "git"}, {"status": "affected", "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "fb2ec564887af1f365d754f7c306f1b5cd375b5e", "versionType": "git"}, {"status": "affected", "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "200b977ebbc313a59174ba971006a231b3533dc5", "versionType": "git"}], "programFiles": ["fs/dlm/recoverd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.11.11", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12.2", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/dlm/recoverd.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e"}, {"url": "https://git.kernel.org/stable/c/fb2ec564887af1f365d754f7c306f1b5cd375b5e"}, {"url": "https://git.kernel.org/stable/c/200b977ebbc313a59174ba971006a231b3533dc5"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix dlm_recover_members refcount on error\n\nIf dlm_recover_members() fails we don't drop the references of the\nprevious created root_list that holds and keep all rsbs alive during the\nrecovery. It might be not an unlikely event because ping_members() could\nrun into an -EINTR if another recovery progress was triggered again."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.11", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.2", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "6.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:21.358Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56749", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:46:21.358Z", "dateReserved": "2024-12-29T11:26:39.759Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-12-29T11:30:15.127Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/dlm/recoverd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3230718a75a6c30ed60ac920c26be2119fa82b8e", "status": "affected", "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "versionType": "git"}, {"lessThan": "fb2ec564887af1f365d754f7c306f1b5cd375b5e", "status": "affected", "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "versionType": "git"}, {"lessThan": "200b977ebbc313a59174ba971006a231b3533dc5", "status": "affected", "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/dlm/recoverd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.11", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "158A6B22-9260-41D7-965A-A81798A5A969", "versionEndExcluding": "6.11.11", "versionStartIncluding": "6.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776", "versionEndExcluding": "6.12.2", "versionStartIncluding": "6.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix dlm_recover_members refcount on error\n\nIf dlm_recover_members() fails we don't drop the references of the\nprevious created root_list that holds and keep all rsbs alive during the\nrecovery. It might be not an unlikely event because ping_members() could\nrun into an -EINTR if another recovery progress was triggered again."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dlm: se corrige el recuento de referencias de dlm_recover_members en caso de error. Si dlm_recover_members() falla, no eliminamos las referencias de la lista ra\u00edz creada anteriormente que contiene y mantenemos todos los rsbs activos durante la recuperaci\u00f3n. Puede que no sea un evento improbable porque ping_members() podr\u00eda encontrarse con un -EINTR si se activa nuevamente otro progreso de recuperaci\u00f3n."}], "id": "CVE-2024-56749", "lastModified": "2026-08-04T11:22:25.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56749", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:57:31.663502Z", "version": "2.0.3"}}]}, "published": "2024-12-29T12:15:08.410", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/200b977ebbc313a59174ba971006a231b3533dc5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fb2ec564887af1f365d754f7c306f1b5cd375b5e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: dlm: fix dlm_recover_members refcount on error", "id": "2334831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334831"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-775", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndlm: fix dlm_recover_members refcount on error\nIf dlm_recover_members() fails we don't drop the references of the\nprevious created root_list that holds and keep all rsbs alive during the\nrecovery. It might be not an unlikely event because ping_members() could\nrun into an -EINTR if another recovery progress was triggered again."], "name": "CVE-2024-56749", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56749\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56749\nhttps://lore.kernel.org/linux-cve-announce/2024122927-CVE-2024-56749-14d1@gregkh/T"], "threat_severity": "Moderate"}

{}