Executive Summary

Informations
Name CVE-2024-41054 First vendor Publication 2024-07-29
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 5.5
Base Score 5.5 Environmental Score 5.5
impact SubScore 3.6 Temporal Score 5.5
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix ufshcd_clear_cmd racing issue

When ufshcd_clear_cmd is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by the ISR. And ufshcd_clear_cmd's call to ufshcd_mcq_req_to_hwq will get NULL pointer KE. Return success when the request is completed by ISR because sq does not need cleanup.

The racing flow is:

Thread A ufshcd_err_handler step 1
ufshcd_try_to_abort_task
ufshcd_cmd_inflight(true) step 3
ufshcd_clear_cmd
...
ufshcd_mcq_req_to_hwq
blk_mq_unique_tag
rq->mq_hctx->queue_num step 5

Thread B ufs_mtk_mcq_intr(cq complete ISR) step 2
scsi_done
...
__blk_mq_free_request
rq->mq_hctx = NULL; step 4

Below is KE back trace:

ufshcd_try_to_abort_task: cmd pending in the device. tag = 6
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194
pc : [0xffffffd589679bf8] blk_mq_unique_tag+0x8/0x14
lr : [0xffffffd5862f95b4] ufshcd_mcq_sq_cleanup+0x6c/0x1cc [ufs_mediatek_mod_ise]
Workqueue: ufs_eh_wq_0 ufshcd_err_handler [ufs_mediatek_mod_ise]
Call trace:
dump_backtrace+0xf8/0x148
show_stack+0x18/0x24
dump_stack_lvl+0x60/0x7c
dump_stack+0x18/0x3c
mrdump_common_die+0x24c/0x398 [mrdump]
ipanic_die+0x20/0x34 [mrdump]
notify_die+0x80/0xd8
die+0x94/0x2b8
__do_kernel_fault+0x264/0x298
do_page_fault+0xa4/0x4b8
do_translation_fault+0x38/0x54
do_mem_abort+0x58/0x118
el1_abort+0x3c/0x5c
el1h_64_sync_handler+0x54/0x90
el1h_64_sync+0x68/0x6c
blk_mq_unique_tag+0x8/0x14
ufshcd_clear_cmd+0x34/0x118 [ufs_mediatek_mod_ise]
ufshcd_try_to_abort_task+0x2c8/0x5b4 [ufs_mediatek_mod_ise]
ufshcd_err_handler+0xa7c/0xfa8 [ufs_mediatek_mod_ise]
process_one_work+0x208/0x4fc
worker_thread+0x228/0x438
kthread+0x104/0x1d4
ret_from_fork+0x10/0x20

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41054

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-476 NULL Pointer Dereference

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8
Os 3635

Sources (Detail)

https://git.kernel.org/stable/c/11d81233f4ebe6907b12c79ad7d8787aa4db0633
https://git.kernel.org/stable/c/9307a998cb9846a2557fdca286997430bee36a2a
https://git.kernel.org/stable/c/bed0896008334eeee4b4bfd7150491ca098cbf72
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
Date Informations
2025-01-08 03:03:46
  • Multiple Updates
2025-01-07 03:03:19
  • Multiple Updates
2024-12-25 03:01:57
  • Multiple Updates
2024-12-12 03:04:54
  • Multiple Updates
2024-11-25 09:23:27
  • Multiple Updates
2024-11-22 21:22:42
  • Multiple Updates
2024-11-21 21:22:13
  • Multiple Updates
2024-11-20 02:58:32
  • Multiple Updates
2024-11-14 02:58:50
  • Multiple Updates
2024-11-09 02:58:51
  • Multiple Updates
2024-10-26 02:56:15
  • Multiple Updates
2024-10-25 02:58:10
  • Multiple Updates
2024-10-23 02:57:23
  • Multiple Updates
2024-10-03 02:52:42
  • Multiple Updates
2024-10-02 02:51:06
  • Multiple Updates
2024-09-15 02:48:52
  • Multiple Updates
2024-09-12 02:48:25
  • Multiple Updates
2024-09-07 02:47:24
  • Multiple Updates
2024-09-06 02:46:34
  • Multiple Updates
2024-09-04 02:49:47
  • Multiple Updates
2024-08-22 21:28:30
  • Multiple Updates
2024-07-29 21:27:27
  • First insertion