CVE-2024-39463·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248 Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335 The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
- Severity
- high
- Software
- Kernel
- Fixed in
- 6.9.5
- Published
- 2024-06-25
Affected versions
From: 6.7
Until: 6.9.5
Fixed in: 6.9.5
How to fix this CVE
Update your Linux kernel to version 6.9.5 or later to resolve a use-after-free vulnerability in the 9p filesystem driver that can lead to memory corruption. This flaw occurs when concurrent dentry lookups and unlink operations access unprotected file identifier lists. Apply the kernel patch immediately and reboot your system to activate the fix.
sudo dnf update kernel kernel-devel && sudo rebootDefensia detects this vulnerability
How to check if you are affected
- Check installed kernel version: uname -r
- Verify if 9p filesystem is mounted: mount | grep 9p
- Monitor dmesg for refcount warnings: dmesg | grep -i 'refcount\|use-after-free'
- Confirm kernel update with: uname -r (should show 6.9.5 or later)
FAQ
What is CVE-2024-39463?
This is a use-after-free vulnerability in the Linux kernel's 9p filesystem driver caused by missing synchronization when concurrent threads access and modify file identifier lists on dentries. An attacker with local access can trigger memory corruption through race conditions between directory lookups and unlink operations.
Is CVE-2024-39463 being actively exploited?
No, this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits have been released.
What versions of Kernel are affected by CVE-2024-39463?
Linux kernel versions 6.7 through 6.9.4 are vulnerable. Version 6.9.5 and later contain the fix.
How do I check if my server is vulnerable to CVE-2024-39463?
Run 'uname -r' to check your kernel version. If it is between 6.7 and 6.9.4, your system is vulnerable. Additionally, check if 9p is in use with 'mount | grep 9p'.
Does Defensia detect CVE-2024-39463?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the Linux kernel is installed on a monitored server, CVE-2024-39463 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
- https://git.kernel.org/stable/c/3bb6763a8319170c2d41c4232c8e7e4c37dcacfb
- https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409
- https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456
- https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5
- https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-39463. Free for 1 server.
Get started free