Log in Start free

Vulnerability · Published Jul 29, 2024 · Assigned by Linux

CVE-2024-41049filelock: fix potential use-after-free in posix_lock_inode

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.106-1DEBIAN-CVE-2024-41049
Debian:13linux6.9.10-1DEBIAN-CVE-2024-41049
Debian:14linux6.9.10-1DEBIAN-CVE-2024-41049
Ubuntu:22.04:LTSlinux5.15.0-121.131UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux6.8.0-48.48UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux6.8.0-48.48USN-7089-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-aws5.15.0-1069.75UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-aws6.8.0-1018.20UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-aws6.8.0-1018.20USN-7089-3
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1018.19~22.04.1USN-7089-3
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1018.19~22.04.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure5.15.0-1072.81UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-azure6.8.0-1017.20USN-7089-2
Ubuntu:24.04:LTSlinux-azure6.8.0-1017.20UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1017.20~22.04.1USN-7090-1
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1017.20~22.04.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1072.81.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-gcp5.15.0-1068.76UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-gcp6.8.0-1017.19UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-gcp6.8.0-1017.19USN-7089-2
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1017.19~22.04.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1017.19~22.04.1USN-7089-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1066.72UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-gke6.8.0-1013.17UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-gke6.8.0-1013.17USN-7089-6
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1052.59UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1002.4UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1002.4USN-7156-1
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-48.48~22.04.1USN-7089-1
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-48.48~22.04.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-ibm5.15.0-1062.65UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-ibm6.8.0-1015.15UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-ibm6.8.0-1015.15USN-7089-2
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1064.70UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-kvm5.15.0-1066.71UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-121.131UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-48.48.3USN-7089-7
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-48.48.3UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-48.48.3~22.04.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-48.48.3~22.04.1USN-7089-7
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1064.65UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1017.19UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1017.19USN-7095-1
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1017.19~22.04.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1017.19~22.04.1USN-7095-1
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1017.19.1UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1017.19.1USN-7095-1
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1016.16USN-7089-4
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1016.16UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-oracle5.15.0-1067.73UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-oracle6.8.0-1015.16UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-oracle6.8.0-1015.16USN-7089-3
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1015.15~22.04.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1015.15~22.04.1USN-7089-3
Ubuntu:22.04:LTSlinux-raspi5.15.0-1062.65UBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-raspi6.8.0-1014.16USN-7089-5
Ubuntu:24.04:LTSlinux-raspi6.8.0-1014.16UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-41049
Ubuntu:24.04:LTSlinux-riscv6.8.0-48.48.1UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-48.48.1~22.04.2UBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-41049
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1035.39UBUNTU-CVE-2024-41049

Affected products (as reported)

VendorProductVersions
Linux Linux 117fb80cd1e63c419c7a221ce070becb4bfc7b6d – before 1cbbb3d9475c403ebedc327490c7c2b991398197a6f4129378ca15f62cbdde09a7d3ccc35adcf49d – before 7d4c14f4b511fd4c0dc788084ae59b4656ace58b766e56faddbec2eaf70c9299e1c9ef74d846d32b – before 02a8964260756c70b20393ad4006948510ac996734bff6d850019e00001129d6de3aa4874c2cf471 – before 5cb36e35bc10ea334810937990c2b9023dacb1b074f6f5912693ce454384eaeec48705646a21c74f – before 432b06b69d1d354a171f7499141116536579eb6a74f6f5912693ce454384eaeec48705646a21c74f – before 116599f6a26906cf33f67975c59f0692ecf7e9b274f6f5912693ce454384eaeec48705646a21c74f – before 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92e75396988bb9b3b90e6e8690604d0f566cea403a
Linux Linux 6.6

References