In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to event_done do_uevent returns the value written to event_done. In case it is a positive value, new_lockspace would undo all the work, and lockspace would not be set. __dlm_new_lockspace, however, would treat that positive value as a success due to commit 8511a2728ab8 ("dlm: fix use count with multiple joins"). Down the line, device_create_lockspace would pass that NULL lockspace to dlm_find_lockspace_local, leading to a NULL pointer dereference. Treating such positive values as successes prevents the problem. Given this has been broken for so long, this is unlikely to break userspace expectations.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dlm: impide NPD al escribir un valor positivo en event_done. do_uevent devuelve el valor escrito en event_done. En caso de ser un valor positivo, new_lockspace desharía todo el trabajo y no se establecería el espacio de bloqueo. Sin embargo, __dlm_new_lockspace trataría ese valor positivo como un éxito debido a el commit 8511a2728ab8 ("dlm: corrige el recuento de uso con múltiples uniones"). Posteriormente, device_create_lockspace pasaría ese espacio de bloqueo nulo a dlm_find_lockspace_local, lo que provocaría una desreferencia de puntero nulo. Tratar estos valores positivos como éxitos evita el problema. Dado que esto ha estado roto durante tanto tiempo, es improbable que esto altere las expectativas del espacio de usuario.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2a2288740> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |