Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2024-04143

Опубликовано: 12 янв. 2024
Источник: fstec
CVSS3: 6.3
CVSS2: 5.5
EPSS Низкий

Описание

Уязвимость функции do_pagemap_scan() в модуле fs/proc/task_mmu.c драйвера псевдо-файловой системы proc ядра операционной системы Linux связана с нарушением механизма синхронизации, приводящем к конкурентному доступу к ресурсу (состояние гонки). Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации

Вендор

Сообщество свободного программного обеспечения

Наименование ПО

Linux

Версия ПО

от 6.7.0 до 6.7.2 включительно (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Сообщество свободного программного обеспечения Linux от 6.7.0 до 6.7.2 включительно

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 5,5)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 6,3)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/20240229155245.1571576-49-lee@kernel.org/T/#u
https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80
https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a
https://git.kernel.org/linus/4cccb6221cae6d020270606b9e52b1678fc8b71a
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.3

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 9%
0.00033
Низкий

6.3 Medium

CVSS3

5.5 Medium

CVSS2

Связанные уязвимости

CVSS3: 7
ubuntu
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [akpm@linux-foundation.org: narrow the scope of `range', per Sean]

CVSS3: 4.7
redhat
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [akpm@linux-foundation.org: narrow the scope of `range', per Sean]

CVSS3: 7
nvd
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [akpm@linux-foundation.org: narrow the scope of `range', per Sean]

CVSS3: 7
debian
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: f ...

CVSS3: 7
github
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [akpm@linux-foundation.org: narrow the scope of `range', per Sean]

EPSS

Процентиль: 9%
0.00033
Низкий

6.3 Medium

CVSS3

5.5 Medium

CVSS2