CVE-2024-39494

CVSS v3.1 7.8 (High)
78% Progress
EPSS 0.04 % (5th)
0.04% Progress
Affected Products 1
Advisories 21
NVD Status Analyzed

In the Linux kernel, the following vulnerability has been resolved:

ima: Fix use-after-free on a dentry's dname.name

->d_name.name can change on rename and the earlier value can be freed;
there are conditions sufficient to stabilize it (->d_lock on dentry,
->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,
rename_lock), but none of those are met at any of the sites. Take a stable
snapshot of the name instead.

Weaknesses
CWE-416
Use After Free
CVE Status
PUBLISHED
NVD Status
Analyzed
CNA
kernel.org
Published Date
2024-07-12 13:15:12
(2 months ago)
Updated Date
2024-07-24 19:17:25
(8 weeks ago)

Affected Products

Loading...
Loading...

Configuration #1

    CPE23 From Up To
  Linux Kernel prior 6.1.97 version cpe:2.3:o:linux:linux_kernel < 6.1.97
  Linux Kernel from 6.2 version and prior 6.6.35 version cpe:2.3:o:linux:linux_kernel >= 6.2 < 6.6.35
  Linux Kernel from 6.7 version and prior 6.9.6 version cpe:2.3:o:linux:linux_kernel >= 6.7 < 6.9.6
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...