Linux: Operation on a Resource after Expiration or Release
CVE-2024-57929 is a high-severity operation on a resource after expiration or release vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 9c7c03d0e926762adf3a3a0ba86156fb5e19538b, fc1ef07c3522e257e32702954f265debbcb096a7, 738994872d77e189b2d13c501a1d145e95d98f46 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 9c7c03d0e926762adf3a3a0ba86156fb5e19538b or fc1ef07c3522e257e32702954f265debbcb096a7 or 738994872d77e189b2d13c501a1d145e95d98f46 or e477021d252c007f0c6d45b5d13d341efed03979, whichever matches your release line, or a later version.
- Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1.1 or a later version.
- Update Linux Kernel to 5.4.290 or 5.10.234 or 5.15.177 or 6.1.125, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | fdd1315aa5f022fe6574efdc2d9535f75a0ee255 up to, but not including, 9c7c03d0e926762adf3a3a0ba86156fb5e19538b; fdd1315aa5f022fe6574efdc2d9535f75a0ee255 up to, but not including, fc1ef07c3522e257e32702954f265debbcb096a7; fdd1315aa5f022fe6574efdc2d9535f75a0ee255 up to, but not including, 738994872d77e189b2d13c501a1d145e95d98f46; fdd1315aa5f022fe6574efdc2d9535f75a0ee255 up to, but not including, e477021d252c007f0c6d45b5d13d341efed03979; fdd1315aa5f022fe6574efdc2d9535f75a0ee255 up to, but not including, 6002bec5354f86d1a2df21468f68e3ec03ede9da; fdd1315aa5f022fe6574efdc2d9535f75a0ee255 up to, but not including, 017c4470bff53585370028fec9341247bad358ff; fdd1315aa5f022fe6574efdc2d9535f75a0ee255 up to, but not including, f2893c0804d86230ffb8f1c8703fdbb18648abc8; 4.9 | 9c7c03d0e926762adf3a3a0ba86156fb5e19538b, fc1ef07c3522e257e32702954f265debbcb096a7, 738994872d77e189b2d13c501a1d145e95d98f46, e477021d252c007f0c6d45b5d13d341efed03979, 6002bec5354f86d1a2df21468f68e3ec03ede9da, 017c4470bff53585370028fec9341247bad358ff |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | before V1.1.1 | V1.1.1 |
| Linux | Linux Kernel | 4.9 up to, but not including, 5.4.290; 5.5 up to, but not including, 5.10.234; 5.11 up to, but not including, 5.15.177; 5.16 up to, but not including, 6.1.125; 6.2 up to, but not including, 6.6.72; 6.7 up to, but not including, 6.12.10; 6.13 | 5.4.290, 5.10.234, 5.15.177, 6.1.125, 6.6.72, 6.12.10 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.1 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put(). Reproduce steps: 1. initialize a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. wipe the second array block offline dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try reopen the cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) device-mapper: array: array_block_check failed: blocknr 0 != wanted 10 device-mapper: block manager: array validator check failed for block 10 device-mapper: array: get_ablock failed device-mapper: cache metadata: dm_array_cursor_next for mapping failed ------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638! Fix by setting the cached block pointer to NULL on errors. In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit: dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
More Operation on a Resource after Expiration or Release vulnerabilities (CWE-672)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/017c4470bff53585370028fec9341247bad358ff
- git.kernel.org/stable/c/6002bec5354f86d1a2df21468f68e3ec03ede9da
- git.kernel.org/stable/c/738994872d77e189b2d13c501a1d145e95d98f46
- git.kernel.org/stable/c/9c7c03d0e926762adf3a3a0ba86156fb5e19538b
- git.kernel.org/stable/c/e477021d252c007f0c6d45b5d13d341efed03979
- git.kernel.org/stable/c/f2893c0804d86230ffb8f1c8703fdbb18648abc8
- git.kernel.org/stable/c/fc1ef07c3522e257e32702954f265debbcb096a7
Other references
Recent Operation on a Resource after Expiration or Release vulnerabilities
- 9.8 Critical severity
- 7.5 High severity
- 7.4 High severity
- 7.8 High severity
- 9.8 Critical severity
- 8.8 High severity
Spotted an error? Tell us.