PT-2024-29198 · Linux+8 · Linux Kernel+8
Baokun Li
·
Published
2024-05-09
·
Updated
2026-05-26
·
CVE-2024-40998
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue arises from the Linux kernel's ext4 file system, where the
ratelimit state->lock is accessed before it is initialized in the ext4 fill super() function. This occurs due to a concurrency issue where ext4 register sysfs registers the msg ratelimit interval ms interface, allowing other processes to modify rs->interval to a non-zero value via this interface while rs->lock is still uninitialized. When ext4 msg is called, it triggers the problem by accessing the uninitialized rs->lock. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.Technical details about exploitation include:
- The
msg ratelimit interval msinterface of sysfs allows modification ofrs->intervalto a non-zero value. - The
ratelimit()function does nothing ifrs->intervalis 0, but if it is non-zero, it attempts to acquire the lock usingraw spin trylock irqsave(&rs->lock, flags). - The
ext4 msgfunction callsratelimit()and triggers the problem by accessing the uninitializedrs->lock. - The
ratelimit state initfunction initializessbi->s msg ratelimit state, andraw spin lock initinitializesrs->lock, but these initializations occur after the sysfs registration.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Improper Initialization
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Linux Kernel
Red Hat
Rocky Linux
Suse
Ubuntu