{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-50210", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.970Z", "datePublished": "2024-11-08T06:08:00.319Z", "dateUpdated": "2024-12-19T09:35:30.669Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:35:30.669Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()\n\nIf get_clock_desc() succeeds, it calls fget() for the clockid's fd,\nand get the clk->rwsem read lock, so the error path should release\nthe lock to make the lock balance and fput the clockid's fd to make\nthe refcount balance and release the fd related resource.\n\nHowever the below commit left the error path locked behind resulting in\nunbalanced locking. Check timespec64_valid_strict() before\nget_clock_desc() to fix it, because the \"ts\" is not changed\nafter that.\n\n[[email protected]: fixed commit message typo]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/posix-clock.c"], "versions": [{"version": "29f085345cde24566efb751f39e5d367c381c584", "lessThan": "d005400262ddaf1ca1666bbcd1acf42fe81d57ce", "status": "affected", "versionType": "git"}, {"version": "e0c966bd3e31911b57ef76cec4c5796ebd88e512", "lessThan": "a8219446b95a859488feaade674d13f9efacfa32", "status": "affected", "versionType": "git"}, {"version": "673a1c5a2998acbd429d6286e6cad10f17f4f073", "lessThan": "c7fcfdba35abc9f39b83080c2bce398dad13a943", "status": "affected", "versionType": "git"}, {"version": "c8789fbe2bbf75845e45302cba6ffa44e1884d01", "lessThan": "e56e0ec1b79f5a6272c6e78b36e9d593aa0449af", "status": "affected", "versionType": "git"}, {"version": "27abbde44b6e71ee3891de13e1a228aa7ce95bfe", "lessThan": "5f063bbf1ee6b01611c016b54e050a41506eb794", "status": "affected", "versionType": "git"}, {"version": "a3f169e398215e71361774d13bf91a0101283ac2", "lessThan": "1ba33b327c3f88a7baee598979d73ab5b44d41cc", "status": "affected", "versionType": "git"}, {"version": "1ff7247101af723731ea42ed565d54fb8f341264", "lessThan": "b27330128eca25179637c1816d5a72d6cc408c66", "status": "affected", "versionType": "git"}, {"version": "d8794ac20a299b647ba9958f6d657051fc51a540", "lessThan": "6e62807c7fbb3c758d233018caf94dfea9c65dbd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/posix-clock.c"], "versions": [{"version": "5.10.228", "lessThan": "5.10.229", "status": "affected", "versionType": "semver"}, {"version": "5.15.169", "lessThan": "5.15.170", "status": "affected", "versionType": "semver"}, {"version": "6.1.114", "lessThan": "6.1.115", "status": "affected", "versionType": "semver"}, {"version": "6.6.58", "lessThan": "6.6.59", "status": "affected", "versionType": "semver"}, {"version": "6.11.5", "lessThan": "6.11.6", "status": "affected", "versionType": "semver"}]}], "references": [{"url": "https://git.kernel.org/stable/c/d005400262ddaf1ca1666bbcd1acf42fe81d57ce"}, {"url": "https://git.kernel.org/stable/c/a8219446b95a859488feaade674d13f9efacfa32"}, {"url": "https://git.kernel.org/stable/c/c7fcfdba35abc9f39b83080c2bce398dad13a943"}, {"url": "https://git.kernel.org/stable/c/e56e0ec1b79f5a6272c6e78b36e9d593aa0449af"}, {"url": "https://git.kernel.org/stable/c/5f063bbf1ee6b01611c016b54e050a41506eb794"}, {"url": "https://git.kernel.org/stable/c/1ba33b327c3f88a7baee598979d73ab5b44d41cc"}, {"url": "https://git.kernel.org/stable/c/b27330128eca25179637c1816d5a72d6cc408c66"}, {"url": "https://git.kernel.org/stable/c/6e62807c7fbb3c758d233018caf94dfea9c65dbd"}], "title": "posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()", "x_generator": {"engine": "bippy-5f407fcff5a0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CEF9F93-A67A-45C9-9C51-0024664ACC19", "versionEndExcluding": "5.11", "versionStartIncluding": "5.10.228", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15.169:*:*:*:*:*:*:*", "matchCriteriaId": "65E5B4C5-20C7-42FD-B670-6B09641CC073", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.114:*:*:*:*:*:*:*", "matchCriteriaId": "CFC6719E-D39A-44B0-90DD-F606EE505404", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6.58:*:*:*:*:*:*:*", "matchCriteriaId": "38BA5D36-31FC-4EF3-9E92-9B67AB6F2D42", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11.5:*:*:*:*:*:*:*", "matchCriteriaId": "101C7DA2-28FF-4CC0-A476-2C8D49CD2AC5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*", "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()\n\nIf get_clock_desc() succeeds, it calls fget() for the clockid's fd,\nand get the clk->rwsem read lock, so the error path should release\nthe lock to make the lock balance and fput the clockid's fd to make\nthe refcount balance and release the fd related resource.\n\nHowever the below commit left the error path locked behind resulting in\nunbalanced locking. Check timespec64_valid_strict() before\nget_clock_desc() to fix it, because the \"ts\" is not changed\nafter that.\n\n[[email protected]: fixed commit message typo]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: posix-clock: posix-clock: Corregir bloqueo desequilibrado en pc_clock_settime() Si get_clock_desc() tiene \u00e9xito, llama a fget() para el fd del clockid y obtiene el bloqueo de lectura clk->rwsem, por lo que la ruta de error deber\u00eda liberar el bloqueo para equilibrar el bloqueo y fput el fd del clockid para equilibrar el refcount y liberar el recurso relacionado con el fd. Sin embargo, la siguiente confirmaci\u00f3n dej\u00f3 la ruta de error bloqueada, lo que result\u00f3 en un bloqueo desequilibrado. Verifique timespec64_valid_strict() antes de get_clock_desc() para corregirlo, porque el \"ts\" no se cambia despu\u00e9s de eso. [[email protected]: se corrigi\u00f3 un error tipogr\u00e1fico en el mensaje de confirmaci\u00f3n]"}], "id": "CVE-2024-50210", "lastModified": "2024-11-19T16:26:34.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-11-08T06:15:17.350", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ba33b327c3f88a7baee598979d73ab5b44d41cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5f063bbf1ee6b01611c016b54e050a41506eb794"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6e62807c7fbb3c758d233018caf94dfea9c65dbd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a8219446b95a859488feaade674d13f9efacfa32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b27330128eca25179637c1816d5a72d6cc408c66"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c7fcfdba35abc9f39b83080c2bce398dad13a943"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d005400262ddaf1ca1666bbcd1acf42fe81d57ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e56e0ec1b79f5a6272c6e78b36e9d593aa0449af"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()", "id": "2324583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2324583"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-667", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nposix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()\nIf get_clock_desc() succeeds, it calls fget() for the clockid's fd,\nand get the clk->rwsem read lock, so the error path should release\nthe lock to make the lock balance and fput the clockid's fd to make\nthe refcount balance and release the fd related resource.\nHowever the below commit left the error path locked behind resulting in\nunbalanced locking. Check timespec64_valid_strict() before\nget_clock_desc() to fix it, because the \"ts\" is not changed\nafter that.\n[[email protected]: fixed commit message typo]"], "name": "CVE-2024-50210", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-11-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-50210\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-50210\nhttps://lore.kernel.org/linux-cve-announce/2024110807-CVE-2024-50210-413b@gregkh/T"], "threat_severity": "Moderate"}