Executive Summary

Informations
Name CVE-2024-41053 First vendor Publication 2024-07-29
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 5.5
Base Score 5.5 Environmental Score 5.5
impact SubScore 3.6 Temporal Score 5.5
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix ufshcd_abort_one racing issue

When ufshcd_abort_one is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by ISR. Return success when request is completed by ISR because ufshcd_abort_one does not need to do anything.

The racing flow is:

Thread A ufshcd_err_handler step 1
...
ufshcd_abort_one
ufshcd_try_to_abort_task
ufshcd_cmd_inflight(true) step 3
ufshcd_mcq_req_to_hwq
blk_mq_unique_tag
rq->mq_hctx->queue_num step 5

Thread B ufs_mtk_mcq_intr(cq complete ISR) step 2
scsi_done
...
__blk_mq_free_request
rq->mq_hctx = NULL; step 4

Below is KE back trace.
ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.
ufshcd_try_to_abort_task: cmd at tag=41 is cleared.
Aborting tag 41 / CDB 0x28 succeeded
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194
pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14
lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]
do_mem_abort+0x58/0x118
el1_abort+0x3c/0x5c
el1h_64_sync_handler+0x54/0x90
el1h_64_sync+0x68/0x6c
blk_mq_unique_tag+0x8/0x14
ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]
process_one_work+0x208/0x4fc
worker_thread+0x228/0x438
kthread+0x104/0x1d4
ret_from_fork+0x10/0x20

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41053

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-476 NULL Pointer Dereference

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8
Os 3635

Sources (Detail)

https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e
https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4
https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
Date Informations
2025-01-08 03:03:46
  • Multiple Updates
2025-01-07 03:03:19
  • Multiple Updates
2024-12-25 03:01:56
  • Multiple Updates
2024-12-12 03:04:54
  • Multiple Updates
2024-11-25 09:23:27
  • Multiple Updates
2024-11-22 21:22:42
  • Multiple Updates
2024-11-21 21:22:13
  • Multiple Updates
2024-11-20 02:58:32
  • Multiple Updates
2024-11-14 02:58:50
  • Multiple Updates
2024-11-09 02:58:51
  • Multiple Updates
2024-10-26 02:56:15
  • Multiple Updates
2024-10-25 02:58:09
  • Multiple Updates
2024-10-23 02:57:22
  • Multiple Updates
2024-10-03 02:52:42
  • Multiple Updates
2024-10-02 02:51:06
  • Multiple Updates
2024-09-15 02:48:52
  • Multiple Updates
2024-09-12 02:48:25
  • Multiple Updates
2024-09-07 02:47:24
  • Multiple Updates
2024-09-06 02:46:34
  • Multiple Updates
2024-09-04 02:49:47
  • Multiple Updates
2024-08-22 02:48:31
  • Multiple Updates
2024-08-22 00:27:49
  • Multiple Updates
2024-07-29 21:27:27
  • First insertion