Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-36891— maple_tree: fix mas_empty_area_rev() null pointer dereference

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于maple_tree模块中mas_empty_area_rev()函数中的空指针取消引用问题。

AI Predicted 4.7 Difficulty: Moderate EPSS 0.23% · P13

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa< 883e5d542bbdddbddeba60250cb482baf3ae2415 affected
54a611b605901c7d5d05b6b8f5d04a6ceb0962aa< 6c9c7c1e63b198a8b979ad963eb21410f10ccb00 affected
54a611b605901c7d5d05b6b8f5d04a6ceb0962aa< f3956791cf526540addd3295e4c1e0f0442486cc affected
54a611b605901c7d5d05b6b8f5d04a6ceb0962aa< 955a923d2809803980ff574270f81510112be9cf affected
6.1 affected
< 6.1 unaffected
6.1.94≤ 6.1.* unaffected
6.6.31≤ 6.6.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-36891

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
maple_tree: fix mas_empty_area_rev() null pointer dereference
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix mas_empty_area_rev() null pointer dereference Currently the code calls mas_start() followed by mas_data_end() if the maple state is MA_START, but mas_start() may return with the maple state node == NULL. This will lead to a null pointer dereference when checking information in the NULL node, which is done in mas_data_end(). Avoid setting the offset if there is no node by waiting until after the maple state is checked for an empty or single entry state. A user could trigger the events to cause a kernel oops by unmapping all vmas to produce an empty maple tree, then mapping a vma that would cause the scenario described above.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于maple_tree模块中mas_empty_area_rev()函数中的空指针取消引用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa ~ 883e5d542bbdddbddeba60250cb482baf3ae2415 -
Linux Linux 6.1 -

II. Public POCs for CVE-2024-36891

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-36891

请登录查看更多情报信息。

Other References for CVE-2024-36891 (4)

Same Patch Batch · Linux · 2024-05-30 · 93 CVEs total

CVE-2024-36958 9.8 CRITICAL NFSD: Fix nfsd4_encode_fattr4() crasher
CVE-2024-36886 9.8 CRITICAL tipc: fix UAF in error path
CVE-2024-36911 9.8 CRITICAL hv_netvsc: Don't free decrypted memory
CVE-2024-36912 9.6 CRITICAL Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
CVE-2024-36913 9.3 CRITICAL Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
CVE-2024-36909 9.3 CRITICAL Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
CVE-2024-36922 8.8 HIGH wifi: iwlwifi: read txq->read_ptr under lock
CVE-2024-36921 8.8 HIGH wifi: iwlwifi: mvm: guard against invalid STA ID on removal
CVE-2024-36910 8.4 HIGH uio_hv_generic: Don't free decrypted memory
CVE-2024-36032 8.1 HIGH Bluetooth: qca: fix info leak when fetching fw build id
CVE-2024-36933 7.8 HIGH nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
CVE-2024-36904 7.8 HIGH tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
CVE-2024-36914 7.8 HIGH drm/amd/display: Skip on writeback when it's not applicable
CVE-2024-36918 7.8 HIGH bpf: Check bloom filter map value size
CVE-2024-36018 7.8 HIGH nouveau/uvmm: fix addr/range calcs for remap operations
CVE-2024-36894 7.8 HIGH usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
CVE-2024-36890 7.8 HIGH mm/slab: make __free(kfree) accept error pointers
CVE-2024-36940 7.8 HIGH pinctrl: core: delete incorrect free in pinctrl_enable()
CVE-2024-36928 7.8 HIGH s390/qeth: Fix kernel panic after setting hsuid
CVE-2024-36884 7.8 HIGH iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()

Showing top 20 of 93 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-36891

No comments yet

Leave a comment