Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-41098— ata: libata-core: Fix null pointer dereference on error

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在ata_host_release函数中，在ata_port_alloc函数调用失败时，尝试无条件释放ata_port结构成员，可能导致空指针取消引用。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.26% · P17

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 633273a3ed1cf37ced90475b0f95cf81deab04f1< d9c4df80b1b009de1eb77c07e3bb4d45bd212aa5 affected
633273a3ed1cf37ced90475b0f95cf81deab04f1< 56e62977eaaae3eb7122ee2cf9b720b6703114a9 affected
633273a3ed1cf37ced90475b0f95cf81deab04f1< e83405e75d90694ee6a5d898f7f0473ac2686054 affected
633273a3ed1cf37ced90475b0f95cf81deab04f1< 221e3b1297e74fdec32d0f572f4dcb2260a0a2af affected
633273a3ed1cf37ced90475b0f95cf81deab04f1< 0f0d37c154bb108730c90a91aa31e3170e827962 affected
633273a3ed1cf37ced90475b0f95cf81deab04f1< 119c97ace2a9ffcf4dc09a23bb057d6c281aff28 affected
633273a3ed1cf37ced90475b0f95cf81deab04f1< 8a8ff7e3b736a70d7b7c8764cbcd2724d4079ec8 affected
633273a3ed1cf37ced90475b0f95cf81deab04f1< 5d92c7c566dc76d96e0e19e481d926bbe6631c1e affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-41098

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ata: libata-core: Fix null pointer dereference on error
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error If the ata_port_alloc() call in ata_host_alloc() fails, ata_host_release() will get called. However, the code in ata_host_release() tries to free ata_port struct members unconditionally, which can lead to the following: BUG: unable to handle page fault for address: 0000000000003990 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:ata_host_release.cold+0x2f/0x6e [libata] Code: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41 RSP: 0018:ffffc90000ebb968 EFLAGS: 00010246 RAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0 RBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68 R10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004 R13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006 FS: 00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? ata_host_release.cold+0x2f/0x6e [libata] ? ata_host_release.cold+0x2f/0x6e [libata] release_nodes+0x35/0xb0 devres_release_group+0x113/0x140 ata_host_alloc+0xed/0x120 [libata] ata_host_alloc_pinfo+0x14/0xa0 [libata] ahci_init_one+0x6c9/0xd20 [ahci] Do not access ata_port struct members unconditionally.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在ata_host_release函数中，在ata_port_alloc函数调用失败时，尝试无条件释放ata_port结构成员，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 633273a3ed1cf37ced90475b0f95cf81deab04f1 ~ d9c4df80b1b009de1eb77c07e3bb4d45bd212aa5 -
Linux Linux 2.6.24 -

II. Public POCs for CVE-2024-41098

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-41098

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-41098 (4)

Other References for CVE-2024-41098 (2)

Same Patch Batch · Linux · 2024-07-29 · 121 CVEs total

CVE-2024-41081 9.8 CRITICAL ila: block BH in ila_output()
CVE-2024-41073 9.8 CRITICAL nvme: avoid double free special payload
CVE-2024-41040 9.8 CRITICAL net/sched: Fix UAF when resolving a clash
CVE-2024-41091 8.8 HIGH tun: add missing verification for short frame
CVE-2024-42083 8.8 HIGH ionic: fix kernel panic due to multi-buffer handling
CVE-2024-41062 8.8 HIGH bluetooth/l2cap: sync sock recv cb and release
CVE-2024-41046 8.8 HIGH net: ethernet: lantiq_etop: fix double free in detach
CVE-2024-41090 8.8 HIGH tap: add missing verification for short frame
CVE-2024-41075 7.8 HIGH cachefiles: add consistency check for copen/cread
CVE-2024-41041 7.8 HIGH udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
CVE-2024-42066 7.8 HIGH drm/xe: Fix potential integer overflow in page size calculation
CVE-2024-41017 7.8 HIGH jfs: don't walk off the end of ealist
CVE-2024-42067 7.8 HIGH bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
CVE-2024-41049 7.8 HIGH filelock: fix potential use-after-free in posix_lock_inode
CVE-2024-41051 7.8 HIGH cachefiles: wait for ondemand_object_worker to finish when dropping object
CVE-2024-42068 7.8 HIGH bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
CVE-2024-42069 7.8 HIGH net: mana: Fix possible double free in error handling path
CVE-2024-41057 7.8 HIGH cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
CVE-2024-41069 7.8 HIGH ASoC: topology: Fix references to freed memory
CVE-2024-42075 7.8 HIGH bpf: Fix remap of arena.

Showing top 20 of 121 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-41098

No comments yet

Leave a comment