{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-39463", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-25T14:23:23.744Z", "datePublished": "2024-06-25T14:25:02.887Z", "dateUpdated": "2026-08-05T11:33:24.281Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:24.281Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: add missing locking around taking dentry fid list\n\nFix a use-after-free on dentry's d_fsdata fid list when a thread\nlooks up a fid through dentry while another thread unlinks it:\n\nUAF thread:\nrefcount_t: addition on 0; use-after-free.\n p9_fid_get linux/./include/net/9p/client.h:262\n v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129\n v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181\n v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314\n v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400\n vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248\n\nFreed by:\n p9_fid_destroy (inlined)\n p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456\n p9_fid_put linux/./include/net/9p/client.h:278\n v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55\n v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518\n vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335\n\nThe problem is that d_fsdata was not accessed under d_lock, because\nd_release() normally is only called once the dentry is otherwise no\nlonger accessible but since we also call it explicitly in v9fs_remove\nthat lock is required:\nmove the hlist out of the dentry under lock then unref its fids once\nthey are no longer accessible." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The race is triggered entirely through local syscalls (`statx()`/`getxattr()` and `unlink()`) issued against a mounted 9p filesystem; no network peer input is required to reach the vulnerable code.\nAC:L - The attacker controls both sides of the race by running two threads (one looping statx, one looping unlink) on the same path, and the window is exceptionally wide because the freed fid remains linked in `d_fsdata` for the entire blocking TCLUNK RPC round-trip; nothing in VFS serializes statx against vfs_unlink.\nPR:L - An unprivileged local user with access to an existing 9p mount (QEMU virtfs share, WSL2, Crostini, Kata/LXD VM guests) can trigger this — both statx and unlink are unprivileged operations needing only write permission on a directory the user already owns.\nUI:N - The attacker performs both racing operations themselves; no victim action is required, as the 9p mount is a pre-existing deployment property rather than an action induced from a user.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; it yields local kernel privilege escalation, not a crossing of a VM/IOMMU boundary.\nC:H - The dangling `struct p9_fid` comes from a general kmalloc slab and is dereferenced after free (`fid->clnt`, `fid->fid`), so heap reclamation gives the attacker a read primitive over adjacent/reclaimed kernel objects and disclosure of kernel pointers.\nI:H - The UAF provides refcount writes into freed memory, a controlled `fid->clnt` pointer dereference used for spinlock/`idr_remove()` operations, a `kfree(fid->rdir)` arbitrary-free, and a double free — a classic path to arbitrary write and control-flow hijack.\nA:H - Even unweaponized, the bug produces a `refcount_t: addition on 0` splat, slab corruption, and kernel oops/panic, and can be triggered repeatedly by any local user with access to the mount." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/9p/vfs_dentry.c" ], "versions": [ { "version": "154372e67d4053e56591245eb413686621941333", "lessThan": "3bb6763a8319170c2d41c4232c8e7e4c37dcacfb", "status": "affected", "versionType": "git" }, { "version": "154372e67d4053e56591245eb413686621941333", "lessThan": "cb299cdba09f46f090b843d78ba26b667d50a456", "status": "affected", "versionType": "git" }, { "version": "154372e67d4053e56591245eb413686621941333", "lessThan": "f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5", "status": "affected", "versionType": "git" }, { "version": "154372e67d4053e56591245eb413686621941333", "lessThan": "fe17ebf22feb4ad7094d597526d558a49aac92b4", "status": "affected", "versionType": "git" }, { "version": "154372e67d4053e56591245eb413686621941333", "lessThan": "c898afdc15645efb555acb6d85b484eb40a45409", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/9p/vfs_dentry.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.94", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.34", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.5", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.94" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.9.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3bb6763a8319170c2d41c4232c8e7e4c37dcacfb" }, { "url": "https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456" }, { "url": "https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5" }, { "url": "https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4" }, { "url": "https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1194/" } ], "title": "9p: add missing locking around taking dentry fid list", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:15.245Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409", "tags": [ "x_transferred" ] } ] }, { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free" } ] } ], "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:5.11:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "versions": [ { "version": "5.11", "status": "affected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "version": "154372e67d40", "status": "affected", "lessThan": "cb299cdba09f", "versionType": "custom" }, { "version": "154372e67d40", "status": "affected", "lessThan": "f0c5c944c6d8", "versionType": "custom" }, { "version": "154372e67d40", "status": "affected", "lessThan": "fe17ebf22feb", "versionType": "custom" }, { "version": "154372e67d40", "status": "affected", "lessThan": "c898afdc1564", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-10T03:55:21.281977Z", "id": "CVE-2024-39463", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-10T15:36:18.860Z" } } ] } }