In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() If get_clock_desc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path should release the lock to make the lock balance and fput the clockid's fd to make the refcount balance and release the fd related resource. However the below commit left the error path locked behind resulting in unbalanced locking. Check timespec64_valid_strict() before get_clock_desc() to fix it, because the "ts" is not changed after that. [[email protected]: fixed commit message typo]
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: posix-clock: posix-clock: Corregir bloqueo desequilibrado en pc_clock_settime() Si get_clock_desc() tiene éxito, llama a fget() para el fd del clockid y obtiene el bloqueo de lectura clk->rwsem, por lo que la ruta de error debería liberar el bloqueo para equilibrar el bloqueo y fput el fd del clockid para equilibrar el refcount y liberar el recurso relacionado con el fd. Sin embargo, la siguiente confirmación dejó la ruta de error bloqueada, lo que resultó en un bloqueo desequilibrado. Verifique timespec64_valid_strict() antes de get_clock_desc() para corregirlo, porque el "ts" no se cambia después de eso. [[email protected]: se corrigió un error tipográfico en el mensaje de confirmación]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-667
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-667
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd370378c00> | Operating System |
| linux | linux_kernel | 5.15.169 | <built-in method update of dict object at 0x7fd36041be80> | Operating System |
| linux | linux_kernel | 6.1.114 | <built-in method update of dict object at 0x7fd39c478140> | Operating System |
| linux | linux_kernel | 6.6.58 | <built-in method update of dict object at 0x7fd3694f3940> | Operating System |
| linux | linux_kernel | 6.11.5 | <built-in method update of dict object at 0x7fd36942ae40> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd36942b600> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.15.169:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1.114:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.6.58:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* |