{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56631", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.838Z", "datePublished": "2024-12-27T15:02:29.428Z", "dateUpdated": "2026-08-05T11:45:34.504Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:34.504Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Fix slab-use-after-free read in sg_release()\n\nFix a use-after-free bug in sg_release(), detected by syzbot with KASAN:\n\nBUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30\nkernel/locking/lockdep.c:5838\n__mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912\nsg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407\n\nIn sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is\ncalled before releasing the open_rel_lock mutex. The kref_put() call may\ndecrement the reference count of sfp to zero, triggering its cleanup\nthrough sg_remove_sfp(). This cleanup includes scheduling deferred work\nvia sg_remove_sfp_usercontext(), which ultimately frees sfp.\n\nAfter kref_put(), sg_release() continues to unlock open_rel_lock and may\nreference sfp or sdp. If sfp has already been freed, this results in a\nslab-use-after-free error.\n\nMove the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the\nopen_rel_lock mutex. This ensures:\n\n - No references to sfp or sdp occur after the reference count is\n decremented.\n\n - Cleanup functions such as sg_remove_sfp() and\n sg_remove_sfp_usercontext() can safely execute without impacting the\n mutex handling in sg_release().\n\nThe fix has been tested and validated by syzbot. This patch closes the\nbug reported at the following syzkaller link and ensures proper\nsequencing of resource cleanup and mutex operations, eliminating the\nrisk of use-after-free errors in sg_release()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is `sg_release()`, reached only by closing a file descriptor obtained from `open(\"/dev/sgN\")`, which requires local access to the SCSI generic character device. No network or remote-peer data is involved.\nAC:L - The attacker drives both sides of the race — `close()` schedules the freeing work, and queuing many threads in `open_wait()` forces `wake_up_interruptible_all()` to walk a long waiter list, stretching the window between `kref_put()` and `mutex_unlock()` so the workqueue lands `kfree(sdp)` first. syzbot produced a working reproducer and confirmed the fix, showing the race is reliably winnable.\nPR:L - No capability check exists in `sg_open()` or `sg_release()`; access is governed purely by permissions on `/dev/sgN`, which are commonly granted to the `disk`/`cdrom` group or to unprivileged users on embedded, Android, kiosk and container deployments. That is ordinary low-privilege access, not real root.\nUI:N - The attacker performs `open()` and `close()` on the device node entirely on their own; no victim action is needed to trigger the use-after-free.\nS:U - The freed `struct sg_device` and the resulting corruption are both within the kernel's own security authority, with no crossing into a hypervisor, IOMMU, or other separate security scope.\nC:H - The freed `sg_device` slab object can be reclaimed by attacker-sprayed data and is subsequently read by `mutex_unlock()`/`lock_release()` and the waitqueue walk, giving control over dereferenced pointers that can be leveraged into arbitrary kernel memory disclosure.\nI:H - After the free, `sg_release()` still performs `sdp->open_cnt--`, `sdp->exclude = false`, waitqueue list manipulation and `mutex_unlock()` on the freed object, yielding write primitives into reclaimed heap memory that are exploitable for control-flow hijacking and privilege escalation.\nA:H - The use-after-free reliably corrupts kernel slab memory and touches a freed mutex and waitqueue, producing KASAN splats, lockdep faults, and kernel panics — a full system crash." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/sg.c" ], "versions": [ { "version": "cc833acbee9db5ca8c6162b015b4c93863c6f821", "lessThan": "e19acb1926c4a1f30ee1ec84d8afba2d975bd534", "status": "affected", "versionType": "git" }, { "version": "cc833acbee9db5ca8c6162b015b4c93863c6f821", "lessThan": "285ce1f89f8d414e7eecab5ef5118cd512596318", "status": "affected", "versionType": "git" }, { "version": "cc833acbee9db5ca8c6162b015b4c93863c6f821", "lessThan": "198b89dd5a595ee3f96e5ce5c448b0484cd0e53c", "status": "affected", "versionType": "git" }, { "version": "cc833acbee9db5ca8c6162b015b4c93863c6f821", "lessThan": "275b8347e21ab8193e93223a8394a806e4ba8918", "status": "affected", "versionType": "git" }, { "version": "cc833acbee9db5ca8c6162b015b4c93863c6f821", "lessThan": "59b30afa578637169e2819536bb66459fdddc39d", "status": "affected", "versionType": "git" }, { "version": "cc833acbee9db5ca8c6162b015b4c93863c6f821", "lessThan": "1f5e2f1ca5875728fcf62bc1a054707444ab4960", "status": "affected", "versionType": "git" }, { "version": "cc833acbee9db5ca8c6162b015b4c93863c6f821", "lessThan": "f10593ad9bc36921f623361c9e3dd96bd52d85ee", "status": "affected", "versionType": "git" }, { "version": "3a27c0defb0315760100f8b1adc7c4acbe04c884", "status": "affected", "versionType": "git" }, { "version": "3.16.85", "lessThan": "3.17", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/sg.c" ], "versions": [ { "version": "3.17", "status": "affected" }, { "version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.290", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.234", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.177", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.127", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.66", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.4.290" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.10.234" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.15.177" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.127" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.66" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.85" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e19acb1926c4a1f30ee1ec84d8afba2d975bd534" }, { "url": "https://git.kernel.org/stable/c/285ce1f89f8d414e7eecab5ef5118cd512596318" }, { "url": "https://git.kernel.org/stable/c/198b89dd5a595ee3f96e5ce5c448b0484cd0e53c" }, { "url": "https://git.kernel.org/stable/c/275b8347e21ab8193e93223a8394a806e4ba8918" }, { "url": "https://git.kernel.org/stable/c/59b30afa578637169e2819536bb66459fdddc39d" }, { "url": "https://git.kernel.org/stable/c/1f5e2f1ca5875728fcf62bc1a054707444ab4960" }, { "url": "https://git.kernel.org/stable/c/f10593ad9bc36921f623361c9e3dd96bd52d85ee" } ], "title": "scsi: sg: Fix slab-use-after-free read in sg_release()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-56631", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-02-11T15:41:55.376597Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:45:22.241Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:51:27.036Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:38:37.830Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ] } ] } }