NetSight
IP …
high7.8

CVE-2024-39494

In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the…

Impact

In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusive on the parent's inode, rename_lock), but none of those are met at any of the sites. Take a stable snapshot of the name instead.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 11.0
LinuxLinux Kernel
from 3.19 before 5.4.291
from 5.5 before 5.10.235
from 5.11 before 5.15.174
from 5.16 before 6.1.97
from 6.2 before 6.6.35
from 6.7 before 6.9.6

Weakness classification

CWE-416

References