目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CVE-2024-38539— Linux kernel 安全漏洞

CVSS 7.5 · High EPSS 0.61% · P46

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 10

ベンダープロダクトVersion Rangeステータス
LinuxLinuxf8ef1be816bf9a0c406c696368c2264a9597a994< 3eb127dc408bf7959a4920d04d16ce10e863686aaffected
f8ef1be816bf9a0c406c696368c2264a9597a994< 6564fc1818404254d1c9f7d75b403b4941516d26affected
f8ef1be816bf9a0c406c696368c2264a9597a994< b3a7fb93afd888793ef226e9665fbda98a95c48eaffected
f8ef1be816bf9a0c406c696368c2264a9597a994< 9c0731832d3b7420cbadba6a7f334363bc8dfb15affected
6.6affected
< 6.6unaffected
6.6.33≤ 6.6.*unaffected
6.8.12≤ 6.8.*unaffected
… +2 more rows
新しい脆弱性情報の通知を購読するログインして購読

I. CVE-2024-38539の基本情報

脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw When running blktests nvme/rdma, the following kmemleak issue will appear. kmemleak: Kernel memory leak detector initialized (mempool available:36041) kmemleak: Automatic memory scanning thread started kmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak) kmemleak: 8 new suspected memory leaks (see /sys/kernel/debug/kmemleak) kmemleak: 17 new suspected memory leaks (see /sys/kernel/debug/kmemleak) kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak) unreferenced object 0xffff88855da53400 (size 192): comm "rdma", pid 10630, jiffies 4296575922 hex dump (first 32 bytes): 37 00 00 00 00 00 00 00 c0 ff ff ff 1f 00 00 00 7............... 10 34 a5 5d 85 88 ff ff 10 34 a5 5d 85 88 ff ff .4.].....4.].... backtrace (crc 47f66721): [<ffffffff911251bd>] kmalloc_trace+0x30d/0x3b0 [<ffffffffc2640ff7>] alloc_gid_entry+0x47/0x380 [ib_core] [<ffffffffc2642206>] add_modify_gid+0x166/0x930 [ib_core] [<ffffffffc2643468>] ib_cache_update.part.0+0x6d8/0x910 [ib_core] [<ffffffffc2644e1a>] ib_cache_setup_one+0x24a/0x350 [ib_core] [<ffffffffc263949e>] ib_register_device+0x9e/0x3a0 [ib_core] [<ffffffffc2a3d389>] 0xffffffffc2a3d389 [<ffffffffc2688cd8>] nldev_newlink+0x2b8/0x520 [ib_core] [<ffffffffc2645fe3>] rdma_nl_rcv_msg+0x2c3/0x520 [ib_core] [<ffffffffc264648c>] rdma_nl_rcv_skb.constprop.0.isra.0+0x23c/0x3a0 [ib_core] [<ffffffff9270e7b5>] netlink_unicast+0x445/0x710 [<ffffffff9270f1f1>] netlink_sendmsg+0x761/0xc40 [<ffffffff9249db29>] __sys_sendto+0x3a9/0x420 [<ffffffff9249dc8c>] __x64_sys_sendto+0xdc/0x1b0 [<ffffffff92db0ad3>] do_syscall_64+0x93/0x180 [<ffffffff92e00126>] entry_SYSCALL_64_after_hwframe+0x71/0x79 The root cause: rdma_put_gid_attr is not called when sgid_attr is set to ERR_PTR(-ENODEV).
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存泄漏。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
LinuxLinux f8ef1be816bf9a0c406c696368c2264a9597a994 ~ 3eb127dc408bf7959a4920d04d16ce10e863686a -
LinuxLinux 6.6 -

II. CVE-2024-38539の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2024-38539のインテリジェンス情報

请登录查看更多情报信息。

CVE-2024-38539 其他参考 (4)

Same Patch Batch · Linux · 2024-06-19 · 122 CVEs total

CVE-2024-3855810.0 CRITICALnet: openvswitch: fix overwriting ct original tuple for ICMPv6
CVE-2021-475879.8 CRITICALnet: systemport: Add global locking for descriptor lifecycle
CVE-2024-385449.8 CRITICALRDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
CVE-2024-385709.8 CRITICALgfs2: Fix potential glock use-after-free on unmount
CVE-2021-476118.1 HIGHmac80211: validate extended element ID is present
CVE-2024-385887.8 HIGHftrace: Fix possible use-after-free issue in ftrace_location()
CVE-2024-385727.8 HIGHwifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
CVE-2024-386107.8 HIGHdrivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
CVE-2024-386057.8 HIGHALSA: core: Fix NULL module pointer assignment at card init
CVE-2024-385997.8 HIGHjffs2: prevent xattr node from overflowing the eraseblock
CVE-2024-385787.8 HIGHecryptfs: Fix buffer size for tag 66 packet
CVE-2024-385927.8 HIGHdrm/mediatek: Init `ddp_comp` with devm_kcalloc()
CVE-2024-385647.8 HIGHbpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2024-385837.8 HIGHnilfs2: fix use-after-free of timer for log writer thread
CVE-2024-385687.8 HIGHdrivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
CVE-2024-385807.8 HIGHepoll: be better about file lifetimes
CVE-2024-385817.8 HIGHdrm/amdgpu/mes: fix use-after-free issue
CVE-2024-385697.8 HIGHdrivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
CVE-2024-386147.8 HIGHopenrisc: traps: Don't send signals to kernel mode threads
CVE-2024-385877.8 HIGHspeakup: Fix sizeof() vs ARRAY_SIZE() bug

Showing 20 of 122 CVEs. View all on vendor page →

IV. 関連脆弱性

同じ製品: Linux
同じベンダー: Linux

V. CVE-2024-38539へのコメント

まだコメントはありません

コメントを残す