In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix UAF for cq async event The refcount of CQ is not protected by locks. When CQ asynchronous events and CQ destruction are concurrent, CQ may have been released, which will cause UAF. Use the xa_lock() to protect the CQ refcount.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42 cve-icon cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024061949-CVE-2024-38545-7161@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-38545 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-38545 cve-icon
History

Wed, 11 Sep 2024 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Aug 2024 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-19T13:35:19.336Z

Updated: 2024-09-11T17:34:57.896Z

Reserved: 2024-06-18T19:36:34.919Z

Link: CVE-2024-38545

cve-icon Vulnrichment

Updated: 2024-08-02T04:12:25.134Z

cve-icon NVD

Status : Analyzed

Published: 2024-06-19T14:15:14.787

Modified: 2024-08-27T20:03:02.983

Link: CVE-2024-38545

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-06-19T00:00:00Z

Links: CVE-2024-38545 - Bugzilla