PT-2024-8379 · Linux+5 · Linux Kernel+5
Matthew Wilcox
+3
·
Published
2024-02-25
·
Updated
2025-03-28
·
CVE-2024-35821
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the ubifs component of the Linux kernel, where page cache reads are lockless. This allows a simultaneous reader to see old data if the freshly allocated page is set uptodate before the new data is copied into it. The vulnerability can be exploited to cause a denial of service. The
SetPageUptodate call has been moved to ubifs write end(), after the new data has been copied into the page, to resolve the issue. The functions write begin slow(), ubifs write begin(), and ubifs write end() in fs/ubifs/file.c are involved in the vulnerability.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Missing Release of Resource after Effective Lifetime
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu