Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-03816

Опубликовано: 16 дек. 2024
Источник: fstec
CVSS3: 5.5
CVSS2: 4.6
EPSS Низкий

Описание

Уязвимость функции !defined() (kernel/sched/core.c) ядра операционной системы Linux связана с выполнением цикла с недоступным условием выхода. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

Novell Inc.
Сообщество свободного программного обеспечения
Red Hat Inc.

Наименование ПО

OpenSUSE Leap
Debian GNU/Linux
Suse Linux Enterprise Server
Suse Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
Red Hat Enterprise Linux
Linux

Версия ПО

15.5 (OpenSUSE Leap)
11 (Debian GNU/Linux)
12 (Debian GNU/Linux)
15.4 (OpenSUSE Leap)
15 SP4 (Suse Linux Enterprise Server)
15 SP4 (Suse Linux Enterprise Desktop)
15 SP4 (SUSE Linux Enterprise Server for SAP Applications)
9 (Red Hat Enterprise Linux)
15 SP5 (SUSE Linux Enterprise Server for SAP Applications)
15 SP5 (Suse Linux Enterprise Server)
15 SP5 (Suse Linux Enterprise Desktop)
15 SP4-LTSS (Suse Linux Enterprise Server)
15 SP6 (Suse Linux Enterprise Desktop)
15 SP6 (Suse Linux Enterprise Server)
15 SP6 (SUSE Linux Enterprise Server for SAP Applications)
15.6 (OpenSUSE Leap)
15 SP5-LTSS (Suse Linux Enterprise Server)
до 5.10.235 (Linux)
до 6.12.18 (Linux)
до 6.13.6 (Linux)
до 6.14 (Linux)
до 5.15.179 (Linux)
до 5.4.291 (Linux)
до 6.1.130 (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Novell Inc. OpenSUSE Leap 15.5
Сообщество свободного программного обеспечения Debian GNU/Linux 11
Сообщество свободного программного обеспечения Debian GNU/Linux 12
Novell Inc. OpenSUSE Leap 15.4
Novell Inc. Suse Linux Enterprise Server 15 SP4
Novell Inc. Suse Linux Enterprise Desktop 15 SP4
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4
Red Hat Inc. Red Hat Enterprise Linux 9
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5
Novell Inc. Suse Linux Enterprise Server 15 SP5
Novell Inc. Suse Linux Enterprise Desktop 15 SP5
Novell Inc. Suse Linux Enterprise Server 15 SP4-LTSS
Novell Inc. Suse Linux Enterprise Desktop 15 SP6
Novell Inc. Suse Linux Enterprise Server 15 SP6
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP6
Novell Inc. OpenSUSE Leap 15.6
Novell Inc. Suse Linux Enterprise Server 15 SP5-LTSS
Сообщество свободного программного обеспечения Linux до 5.10.235
Сообщество свободного программного обеспечения Linux до 6.12.18
Сообщество свободного программного обеспечения Linux до 6.13.6
Сообщество свободного программного обеспечения Linux до 6.14
Сообщество свободного программного обеспечения Linux до 5.15.179
Сообщество свободного программного обеспечения Linux до 5.4.291
Сообщество свободного программного обеспечения Linux до 6.1.130

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4,6)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 5,5)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года
Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2025032703-CVE-2024-58090-fddc@gregkh/T/#u
https://git.kernel.org/stable/c/0362847c520747b44b574d363705d8af0621727a
https://git.kernel.org/stable/c/1651f5731b378616565534eb9cda30e258cebebc
https://git.kernel.org/stable/c/288fdb8dcb71ec77b76ab8b8a06bc10f595ea504
https://git.kernel.org/stable/c/321794b75ac968f0bb6b9c913581949452a8d992
https://git.kernel.org/stable/c/68786ab0935ccd5721283b7eb7f4d2f2942c7a52
https://git.kernel.org/stable/c/82c387ef7568c0d96a918a5a78d9cad6256cfa15
https://git.kernel.org/stable/c/84586322e010164eedddfcd0a0894206ae7d9317
https://git.kernel.org/stable/c/b927c8539f692fb1f9c2f42e6c8ea2d94956f921
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.18
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.235
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.179
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.291
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.130
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.6
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2024-58090.html
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2024-58090
Для программных продуктов Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2024-58090

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 16%
0.00053
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2

Связанные уязвимости

ubuntu
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning observed while loop testing kexec jump: Interrupts enabled after irqrouter_resume+0x0/0x50 WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220 kernel_kexec+0xf6/0x180 __do_sys_reboot+0x206/0x250 do_syscall_64+0x95/0x180 The corresponding interrupt flag trace: hardirqs last enabled at (15573): [<ffffffffa8281b8e>] __up_console_sem+0x7e/0x90 hardirqs last disabled at (15580): [<ffffffffa8281b73>] __up_console_sem+0x63/0x90 That means __up_console_sem() was invoked with interrupts enabled. Further instrumentation revealed that in the interrupt disabled section of kexec jump one of the syscore_suspend() callbacks woke up a task, which set the NEED_RESCHED flag. A later callback in the resume path invoked cond_resched() which in turn led to the invocation of the scheduler: __cond_resched+0x21/0x60 ...

CVSS3: 5.5
redhat
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning observed while loop testing kexec jump: Interrupts enabled after irqrouter_resume+0x0/0x50 WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220 kernel_kexec+0xf6/0x180 __do_sys_reboot+0x206/0x250 do_syscall_64+0x95/0x180 The corresponding interrupt flag trace: hardirqs last enabled at (15573): [<ffffffffa8281b8e>] __up_console_sem+0x7e/0x90 hardirqs last disabled at (15580): [<ffffffffa8281b73>] __up_console_sem+0x63/0x90 That means __up_console_sem() was invoked with interrupts enabled. Further instrumentation revealed that in the interrupt disabled section of kexec jump one of the syscore_suspend() callbacks woke up a task, which set the NEED_RESCHED flag. A later callback in the resume path invoked cond_resched() which in turn led to the invocation of the scheduler: __cond_resched+0x21/0x60 down_ti...

nvd
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning observed while loop testing kexec jump: Interrupts enabled after irqrouter_resume+0x0/0x50 WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220 kernel_kexec+0xf6/0x180 __do_sys_reboot+0x206/0x250 do_syscall_64+0x95/0x180 The corresponding interrupt flag trace: hardirqs last enabled at (15573): [<ffffffffa8281b8e>] __up_console_sem+0x7e/0x90 hardirqs last disabled at (15580): [<ffffffffa8281b73>] __up_console_sem+0x63/0x90 That means __up_console_sem() was invoked with interrupts enabled. Further instrumentation revealed that in the interrupt disabled section of kexec jump one of the syscore_suspend() callbacks woke up a task, which set the NEED_RESCHED flag. A later callback in the resume path invoked cond_resched() which in turn led to the invocation of the scheduler: __cond_re

debian
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: s ...

github
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning observed while loop testing kexec jump: Interrupts enabled after irqrouter_resume+0x0/0x50 WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220 kernel_kexec+0xf6/0x180 __do_sys_reboot+0x206/0x250 do_syscall_64+0x95/0x180 The corresponding interrupt flag trace: hardirqs last enabled at (15573): [<ffffffffa8281b8e>] __up_console_sem+0x7e/0x90 hardirqs last disabled at (15580): [<ffffffffa8281b73>] __up_console_sem+0x63/0x90 That means __up_console_sem() was invoked with interrupts enabled. Further instrumentation revealed that in the interrupt disabled section of kexec jump one of the syscore_suspend() callbacks woke up a task, which set the NEED_RESCHED flag. A later callback in the resume path invoked cond_resched() which in turn led to the invocation of the scheduler: __cond...

EPSS

Процентиль: 16%
0.00053
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2