Описание
In the Linux kernel, the following vulnerability has been resolved:
dma-buf: insert memory barrier before updating num_fences
smp_store_mb() inserts memory barrier after storing operation.
It is different with what the comment is originally aiming so Null
pointer dereference can be happened if memory update is reordered.
A flaw was found in the Linux kernel's dma-buf component. An issue with memory barrier usage (smp_store_mb()) can lead to memory update reordering. A local attacker could exploit this to cause a Null pointer dereference, resulting in a system crash (Denial of Service). This vulnerability may also lead to information disclosure or arbitrary code execution.
Отчет
A flaw of moderate severity was found in the Linux kernel's dma-buf subsystem, affecting the Red Hat Enterprise Linux 9 and 10 kernels (including kernel-rt) and the Red Hat In-Vehicle OS 1.x kernel. The dma-buf fence-signaling code used smp_store_mb() to update the num_fences field. Because smp_store_mb() inserts the memory barrier after the store operation rather than before it, the intended ordering guarantee was not provided, and the memory update could be reordered. A local attacker could exploit this reordering to trigger a NULL pointer dereference, causing a kernel crash and resulting in denial of service. Red Hat Enterprise Linux 6, 7, and 8 are marked not affected because the vulnerable code is not present in those streams. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with local privileges and the verified consequence is limited to system availability. This differs from the CVE.org record, which scores the flaw 7.8 with high confidentiality and integrity impact; Red Hat's assessment found the demonstrated impact to be a NULL pointer dereference causing a system crash, with no evidence supporting information disclosure or arbitrary code execution. The fix for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS streams is deferred. Given the local attack vector, the privilege requirement, and the availability-only impact, the residual risk while the fix is deferred is limited to a local denial of service.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.
EPSS
5.5 Medium
CVSS3