跳转到帖子

Amazon Linux AMI: CVE-2024-49936: Security patch for kernel (ALAS-2025-1957)

recommended_posts

发布于
  • Members

Amazon Linux AMI: CVE-2024-49936: Security patch for kernel (ALAS-2025-1957)

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
10/21/2024
Created
02/11/2025
Added
02/06/2025
Modified
02/06/2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net/xen-netback: prevent UAF in xenvif_flush_hash()

During the list_for_each_entry_rcu iteration call of xenvif_flush_hash,

kfree_rcu does not exist inside the rcu read critical section, so if

kfree_rcu is called when the rcu grace period ends during the iteration,

UAF occurs when accessing head->next after the entry becomes free.

Therefore, to solve this, you need to change it to list_for_each_entry_safe.

Solution(s)

  • amazon-linux-upgrade-kernel

References

  • ALAS-2025-1957
  • CVE-2024-49936
  • 查看数 693
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…