CVE-2024-35808

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35808

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: md/dm-raid: don't call md_reap_sync_thread() directly Currently md_reap_sync_thread() is called from raid_message() directly without holding 'reconfig_mutex', this is definitely unsafe because md_reap_sync_thread() can change many fields that is protected by 'reconfig_mutex'. However, hold 'reconfig_mutex' here is still problematic because this will cause deadlock, for example, commit 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). Fix this problem by using stop_sync_thread() to unregister sync_thread, like md/raid did.

References
Link Resource
https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc Patch
https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669 Patch
https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0 Patch
https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc Patch
https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669 Patch
https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

19 Sep 2025, 16:02

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc - () https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc - Patch
References () https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669 - () https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669 - Patch
References () https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0 - () https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-667
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 09:20

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc - () https://git.kernel.org/stable/c/347dcdc15a1706f61aa545ae498ededdf31aeebc -
References () https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669 - () https://git.kernel.org/stable/c/9e59b8d76ff511505eb0dd1478329f09e0f04669 -
References () https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0 - () https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: md/dm-raid: no llame a md_reap_sync_thread() directamente Actualmente, se llama a md_reap_sync_thread() desde raid_message() directamente sin mantener presionado 'reconfig_mutex', esto definitivamente no es seguro porque md_reap_sync_thread( ) puede cambiar muchos campos protegidos por 'reconfig_mutex'. Sin embargo, mantener 'reconfig_mutex' aquí sigue siendo problemático porque esto causará un punto muerto, por ejemplo, confirme 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). Solucione este problema usando stop_sync_thread() para cancelar el registro de sync_thread, como lo hizo md/raid.

17 May 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 14:15

Updated : 2025-09-19 16:02

NVD link : CVE-2024-35808

Mitre link : CVE-2024-35808

CVE.ORG link : CVE-2024-35808

JSON object : View

Products Affected

linux

CWE
CWE-667

Improper Locking