NVD Vulnerability Detail

CVE-2024-50133

Summary	In the Linux kernel, the following vulnerability has been resolved: LoongArch: Don't crash in stack_top() for tasks without vDSO Not all tasks have a vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL vdso pointer and crash. This can for example happen when using kunit: [<9000000000203874>] stack_top+0x58/0xa8 [<90000000002956cc>] arch_pick_mmap_layout+0x164/0x220 [<90000000003c284c>] kunit_vm_mmap_init+0x108/0x12c [<90000000003c1fbc>] __kunit_add_resource+0x38/0x8c [<90000000003c2704>] kunit_vm_mmap+0x88/0xc8 [<9000000000410b14>] usercopy_test_init+0xbc/0x25c [<90000000003c1db4>] kunit_try_run_case+0x5c/0x184 [<90000000003c3d54>] kunit_generic_run_threadfn_adapter+0x24/0x48 [<900000000022e4bc>] kthread+0xc8/0xd4 [<9000000000200ce8>] ret_from_kernel_thread+0xc/0xa4
Publication Date	Nov. 6, 2024, 3:15 a.m.
Registration Date	Nov. 6, 2024, 5 a.m.
Last Update	Nov. 8, 2024, 6:17 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://git.kernel.org/stable/c/a67d4a02bf43e15544179895ede7d5f97b84b550	Patch
2	https://git.kernel.org/stable/c/a94c197d4d749954dfaa37e907fcc8c04e4aad7e	Patch
3	https://git.kernel.org/stable/c/041cc3860b06770357876d1114d615333b0fbf31	Patch
4	https://git.kernel.org/stable/c/134475a9ab8487527238d270639a8cb74c10aab2	Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-476	NULL ポインタデリファレンス	https://cwe.mitre.org/data/definitions/476.html

JVN Vulnerability Information

Linux の Linux Kernel における NULL ポインタデリファレンスに関する脆弱性

Title	Linux の Linux Kernel における NULL ポインタデリファレンスに関する脆弱性
Summary	Linux の Linux Kernel には、NULL ポインタデリファレンスに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 21, 2024, midnight
Registration Date	Nov. 11, 2024, 6:11 p.m.
Last Update	Nov. 11, 2024, 6:11 p.m.

Affected System

Linux

Linux Kernel 5.19 以上 6.1.115 未満

Linux Kernel 6.12

Linux Kernel 6.2 以上 6.6.59 未満

Linux Kernel 6.7 以上 6.11.6 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2024-50133	https://www.cve.org/CVERecord?id=CVE-2024-50133
National Vulnerability Database (NVD)
2	CVE-2024-50133	https://nvd.nist.gov/vuln/detail/CVE-2024-50133

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-476	http://cwe.mitre.org/data/definitions/476.html

ベンダー情報

No	Name	URL
Kernel.org git repositories
1	LoongArch: Don't crash in stack_top() for tasks without vDSO (041cc38)	https://git.kernel.org/stable/c/041cc3860b06770357876d1114d615333b0fbf31
2	LoongArch: Don't crash in stack_top() for tasks without vDSO (134475a)	https://git.kernel.org/stable/c/134475a9ab8487527238d270639a8cb74c10aab2
3	LoongArch: Don't crash in stack_top() for tasks without vDSO (a67d4a0)	https://git.kernel.org/stable/c/a67d4a02bf43e15544179895ede7d5f97b84b550
4	LoongArch: Don't crash in stack_top() for tasks without vDSO (a94c197)	https://git.kernel.org/stable/c/a94c197d4d749954dfaa37e907fcc8c04e4aad7e
Linux Kernel
5	Linux Kernel Archives	https://www.kernel.org

Change Log

No	Changed Details	Date of change
1	[2024年11月11日] 掲載	Nov. 11, 2024, 6:11 p.m.