CVE-2024-42254

EUVD-2024-39477
In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix error pbuf checking

Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent
error handling in io_alloc_pbuf_ring().

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341
Call Trace:
 <TASK>
 io_put_bl io_uring/kbuf.c:378 [inline]
 io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392
 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613
 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 9%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
6.10
linuxlinux_kernel
6.10:rc1
linuxlinux_kernel
6.10:rc2
linuxlinux_kernel
6.10:rc3
linuxlinux_kernel
6.10:rc4
linuxlinux_kernel
6.10:rc5
linuxlinux_kernel
6.10:rc6
linuxlinux_kernel
6.10:rc7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
6.1.148-1
fixed
bookworm (security)
6.1.158-1
fixed
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.247-1
fixed
forky
6.17.13-1
fixed
sid
6.17.13-1
fixed
trixie
6.12.57-1
fixed
trixie (security)
6.12.48-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
trusty
not-affected
xenial
not-affected
linux-hwe
bionic
ignored
focal
dne
jammy
dne
noble
dne
xenial
not-affected
linux-hwe-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-hwe-5.8
focal
ignored
jammy
dne
noble
dne
linux-hwe-5.11
focal
ignored
jammy
dne
noble
dne
linux-hwe-5.13
focal
ignored
jammy
dne
noble
dne
linux-hwe-5.15
focal
not-affected
jammy
dne
noble
dne
linux-hwe-5.19
focal
dne
jammy
ignored
noble
dne
linux-hwe-6.2
focal
dne
jammy
ignored
noble
dne
linux-hwe-6.5
focal
dne
jammy
ignored
noble
dne
linux-hwe-edge
bionic
ignored
focal
dne
jammy
dne
noble
dne
xenial
ignored
linux-lts-xenial
focal
dne
jammy
dne
noble
dne
trusty
not-affected
linux-kvm
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
xenial
not-affected
linux-allwinner-5.19
focal
dne
jammy
ignored
noble
dne
linux-aws
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
trusty
not-affected
xenial
not-affected
linux-aws-5.0
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-aws-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-aws-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-aws-5.8
focal
ignored
jammy
dne
noble
dne
linux-aws-5.11
focal
ignored
jammy
dne
noble
dne
linux-aws-5.13
focal
ignored
jammy
dne
noble
dne
linux-aws-5.15
focal
not-affected
jammy
dne
noble
dne
linux-aws-5.19
focal
dne
jammy
ignored
noble
dne
linux-aws-6.2
focal
dne
jammy
ignored
noble
dne
linux-aws-6.5
focal
dne
jammy
ignored
noble
dne
linux-aws-hwe
focal
dne
jammy
dne
noble
dne
xenial
not-affected
linux-azure
bionic
ignored
focal
not-affected
jammy
not-affected
noble
not-affected
trusty
not-affected
xenial
not-affected
linux-azure-4.15
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-azure-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-azure-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-azure-5.8
focal
ignored
jammy
dne
noble
dne
linux-azure-5.11
focal
ignored
jammy
dne
noble
dne
linux-azure-5.13
focal
ignored
jammy
dne
noble
dne
linux-azure-5.15
focal
not-affected
jammy
dne
noble
dne
linux-azure-5.19
focal
dne
jammy
ignored
noble
dne
linux-azure-6.2
focal
dne
jammy
ignored
noble
dne
linux-azure-6.5
focal
dne
jammy
ignored
noble
dne
linux-azure-fde
focal
ignored
jammy
not-affected
noble
not-affected
linux-azure-fde-5.15
focal
not-affected
jammy
dne
noble
dne
linux-azure-fde-5.19
focal
dne
jammy
ignored
noble
dne
linux-azure-fde-6.2
focal
dne
jammy
ignored
noble
dne
linux-bluefield
focal
not-affected
jammy
dne
noble
dne
linux-azure-edge
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
xenial
not-affected
linux-aws-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
linux-azure-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
linux-gcp-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
linux-gcp
bionic
ignored
focal
not-affected
jammy
not-affected
noble
not-affected
xenial
not-affected
linux-gcp-4.15
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-gcp-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-gcp-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-gcp-5.8
focal
ignored
jammy
dne
noble
dne
linux-gcp-5.11
focal
ignored
jammy
dne
noble
dne
linux-gcp-5.13
focal
ignored
jammy
dne
noble
dne
linux-gcp-5.15
focal
not-affected
jammy
dne
noble
dne
linux-gcp-5.19
focal
dne
jammy
ignored
noble
dne
linux-gcp-6.2
focal
dne
jammy
ignored
noble
dne
linux-gcp-6.5
focal
dne
jammy
ignored
noble
dne
linux-gke
focal
ignored
jammy
not-affected
noble
not-affected
linux-gke-4.15
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-gke-5.4
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-gke-5.15
focal
ignored
jammy
dne
noble
dne
linux-gkeop
focal
not-affected
jammy
not-affected
noble
not-affected
linux-gkeop-5.4
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-gkeop-5.15
focal
not-affected
jammy
dne
noble
dne
linux-ibm
focal
not-affected
jammy
not-affected
noble
not-affected
linux-ibm-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-ibm-5.15
focal
not-affected
jammy
dne
noble
dne
linux-intel-5.13
focal
ignored
jammy
dne
noble
dne
linux-intel-iotg
focal
dne
jammy
not-affected
noble
dne
linux-intel-iotg-5.15
focal
not-affected
jammy
dne
noble
dne
linux-iot
focal
not-affected
jammy
dne
noble
dne
linux-lowlatency
focal
dne
jammy
not-affected
noble
not-affected
linux-lowlatency-hwe-5.15
focal
not-affected
jammy
dne
noble
dne
linux-lowlatency-hwe-5.19
focal
dne
jammy
ignored
noble
dne
linux-lowlatency-hwe-6.2
focal
dne
jammy
ignored
noble
dne
linux-lowlatency-hwe-6.5
focal
dne
jammy
ignored
noble
dne
linux-nvidia
focal
dne
jammy
not-affected
noble
not-affected
linux-nvidia-6.2
focal
dne
jammy
ignored
noble
dne
linux-nvidia-6.5
focal
dne
jammy
not-affected
noble
dne
linux-nvidia-6.8
focal
dne
jammy
not-affected
noble
dne
linux-nvidia-lowlatency
focal
dne
jammy
dne
noble
not-affected
linux-oracle
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
xenial
not-affected
linux-oracle-5.0
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-oracle-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-oracle-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-oracle-5.8
focal
ignored
jammy
dne
noble
dne
linux-oracle-5.11
focal
ignored
jammy
dne
noble
dne
linux-oracle-5.13
focal
ignored
jammy
dne
noble
dne
linux-oracle-5.15
focal
not-affected
jammy
dne
noble
dne
linux-oracle-6.5
focal
dne
jammy
ignored
noble
dne
linux-oem
bionic
ignored
focal
dne
jammy
dne
noble
dne
linux-oem-5.6
focal
ignored
jammy
dne
noble
dne
linux-oem-5.10
focal
ignored
jammy
dne
noble
dne
linux-oem-5.13
focal
ignored
jammy
dne
noble
dne
linux-oem-5.14
focal
ignored
jammy
dne
noble
dne
linux-oem-5.17
focal
dne
jammy
ignored
noble
dne
linux-oem-6.0
focal
dne
jammy
ignored
noble
dne
linux-oem-6.1
focal
dne
jammy
ignored
noble
dne
linux-oem-6.5
focal
dne
jammy
ignored
noble
dne
linux-oem-6.8
focal
dne
jammy
dne
noble
not-affected
linux-raspi
focal
not-affected
jammy
not-affected
noble
not-affected
linux-raspi2
focal
ignored
jammy
dne
noble
dne
linux-raspi-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
linux-riscv
focal
ignored
jammy
ignored
noble
not-affected
linux-riscv-5.8
focal
ignored
jammy
dne
noble
dne
linux-riscv-5.11
focal
ignored
jammy
dne
noble
dne
linux-riscv-5.15
focal
not-affected
jammy
dne
noble
dne
linux-riscv-5.19
focal
dne
jammy
ignored
noble
dne
linux-riscv-6.5
focal
dne
jammy
ignored
noble
dne
linux-starfive-5.19
focal
dne
jammy
ignored
noble
dne
linux-starfive-6.2
focal
dne
jammy
ignored
noble
dne
linux-starfive-6.5
focal
dne
jammy
ignored
noble
dne
linux-xilinx-zynqmp
focal
not-affected
jammy
not-affected
noble
dne
linux-hwe-6.8
bionic
dne
focal
dne
jammy
not-affected
noble
dne
trusty
dne
xenial
dne
linux-lowlatency-hwe-6.8
bionic
dne
focal
dne
jammy
not-affected
noble
dne
trusty
dne
xenial
dne
linux-riscv-6.8
bionic
dne
focal
dne
jammy
not-affected
noble
dne
trusty
dne
xenial
dne
linux-intel
bionic
dne
focal
dne
jammy
dne
noble
not-affected
trusty
dne
xenial
dne
linux-intel-iot-realtime
bionic
dne
focal
dne
jammy
not-affected
noble
dne
trusty
dne
xenial
dne
linux-raspi-realtime
bionic
dne
focal
dne
jammy
dne
noble
not-affected
trusty
dne
xenial
dne
linux-realtime
bionic
dne
focal
dne
jammy
not-affected
noble
not-affected
trusty
dne
xenial
dne