CVE-2024-39494 (GCVE-0-2024-39494)
Vulnerability from cvelistv5
Published
2024-07-12 12:20
Modified
2026-08-05 11:33
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusive on the parent's inode, rename_lock), but none of those are met at any of the sites. Take a stable snapshot of the name instead.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2fe5d6def1672ae6635dd71867bf36dcfaa7434b
Version: 2fe5d6def1672ae6635dd71867bf36dcfaa7434b
Version: 2fe5d6def1672ae6635dd71867bf36dcfaa7434b
Version: 2fe5d6def1672ae6635dd71867bf36dcfaa7434b
Version: 2fe5d6def1672ae6635dd71867bf36dcfaa7434b
Version: 2fe5d6def1672ae6635dd71867bf36dcfaa7434b
Version: 2fe5d6def1672ae6635dd71867bf36dcfaa7434b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:56:11.179Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:07:29.508967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:39.893Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_api.c",
            "security/integrity/ima/ima_template_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "480afcbeb7aaaa22677d3dd48ec590b441eaac1a",
              "status": "affected",
              "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b",
              "versionType": "git"
            },
            {
              "lessThan": "edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb",
              "status": "affected",
              "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b",
              "versionType": "git"
            },
            {
              "lessThan": "0b31e28fbd773aefb6164687e0767319b8199829",
              "status": "affected",
              "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b",
              "versionType": "git"
            },
            {
              "lessThan": "7fb374981e31c193b1152ed8d3b0a95b671330d4",
              "status": "affected",
              "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b",
              "versionType": "git"
            },
            {
              "lessThan": "dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c",
              "status": "affected",
              "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b",
              "versionType": "git"
            },
            {
              "lessThan": "a78a6f0da57d058e2009e9958fdcef66f165208c",
              "status": "affected",
              "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b",
              "versionType": "git"
            },
            {
              "lessThan": "be84f32bb2c981ca670922e047cdde1488b233de",
              "status": "affected",
              "version": "2fe5d6def1672ae6635dd71867bf36dcfaa7434b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_api.c",
            "security/integrity/ima/ima_template_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.97",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Fix use-after-free on a dentry\u0027s dname.name\n\n-\u003ed_name.name can change on rename and the earlier value can be freed;\nthere are conditions sufficient to stabilize it (-\u003ed_lock on dentry,\n-\u003ed_lock on its parent, -\u003ei_rwsem exclusive on the parent\u0027s inode,\nrename_lock), but none of those are met at any of the sites. Take a stable\nsnapshot of the name instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable sites are reached through `security_file_post_open`/`bprm_check_security`/`mmap_file` from ordinary `open(2)`, `execve(2)` and `mmap(PROT_EXEC)` syscalls, and the racing free comes from a local `rename(2)`; no remote peer data is parsed by the affected code.\nAC:L - The attacker owns both sides of the race \u2014 one thread execs/opens the file to start measurement, another renames it \u2014 and the window is enormous: `ima_collect_measurement()` hashes the entire file between capturing and dereferencing the pointer, and `ima_eventname_init_common()` has a sleeping `kzalloc(GFP_KERNEL)` between its `strlen()` and `memcpy()`, both far exceeding the RCU grace period that `kfree_rcu()` waits for. CONFIG_IMA with a measurement policy is standard on distro, attestation and secure-boot systems, and the sequence can be looped indefinitely.\nPR:L - Any unprivileged local user can trigger it by exec\u0027ing or opening a file it owns (builtin `tcb` policy measures `BPRM_CHECK`/`MMAP_CHECK` for all uids, and tmpfs is only excluded for `FILE_CHECK`) while renaming that file in a directory it controls such as /tmp or $HOME. No capability, root, or user-namespace trick is required.\nUI:N - Both halves of the race are performed by the attacker\u0027s own two threads; no victim ever has to open, mount, or execute anything.\nS:U - The stale dereference reads kernel heap memory within the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `external_name` is a plain `GFP_KERNEL_ACCOUNT` kmalloc object that returns to the kmalloc-cg slab and can be reclaimed by attacker-sprayed or sensitive kernel objects, and the `strlen()` over it is unbounded so the read runs past the original allocation into adjacent slab data. Those bytes are copied verbatim into the IMA measurement log exposed via securityfs and sent to remote attestation verifiers, and into audit records \u2014 bulk kernel heap disclosure.\nI:H - Attacker-chosen bytes from the reclaimed object land unescaped in the IMA measurement log (`ima_write_template_field_data()` only rewrites spaces, so injected newlines forge whole entries in the newline-delimited `ascii_runtime_measurements` stream) and are hashed into the TPM PCR, corrupting exactly the attestation and audit evidence IMA exists to produce; per use-after-free scoring, reclaim control over the freed object also supports heap-grooming toward stronger primitives.\nA:H - The unbounded `strlen()`/`memcpy()` over a freed slab object whose page may already have been released can fault on unmapped memory and oops the kernel, and the garbage length also feeds `kzalloc()` and audit-buffer sizing; on KASAN/hardened kernels the use-after-free faults immediately, and the whole sequence is repeatable at will by any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:43.864Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/480afcbeb7aaaa22677d3dd48ec590b441eaac1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b31e28fbd773aefb6164687e0767319b8199829"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c"
        },
        {
          "url": "https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de"
        }
      ],
      "title": "ima: Fix use-after-free on a dentry\u0027s dname.name",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39494",
    "datePublished": "2024-07-12T12:20:30.348Z",
    "dateReserved": "2024-06-25T14:23:23.748Z",
    "dateUpdated": "2026-08-05T11:33:43.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:15.999Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39494\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:07:29.508967Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.066Z\"}}], \"cna\": {\"title\": \"ima: Fix use-after-free on a dentry\u0027s dname.name\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2fe5d6def1672ae6635dd71867bf36dcfaa7434b\", \"lessThan\": \"480afcbeb7aaaa22677d3dd48ec590b441eaac1a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2fe5d6def1672ae6635dd71867bf36dcfaa7434b\", \"lessThan\": \"edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2fe5d6def1672ae6635dd71867bf36dcfaa7434b\", \"lessThan\": \"0b31e28fbd773aefb6164687e0767319b8199829\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2fe5d6def1672ae6635dd71867bf36dcfaa7434b\", \"lessThan\": \"7fb374981e31c193b1152ed8d3b0a95b671330d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2fe5d6def1672ae6635dd71867bf36dcfaa7434b\", \"lessThan\": \"dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2fe5d6def1672ae6635dd71867bf36dcfaa7434b\", \"lessThan\": \"a78a6f0da57d058e2009e9958fdcef66f165208c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2fe5d6def1672ae6635dd71867bf36dcfaa7434b\", \"lessThan\": \"be84f32bb2c981ca670922e047cdde1488b233de\", \"versionType\": \"git\"}], \"programFiles\": [\"security/integrity/ima/ima_api.c\", \"security/integrity/ima/ima_template_lib.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.291\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.235\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.174\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.97\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"security/integrity/ima/ima_api.c\", \"security/integrity/ima/ima_template_lib.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/480afcbeb7aaaa22677d3dd48ec590b441eaac1a\"}, {\"url\": \"https://git.kernel.org/stable/c/edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb\"}, {\"url\": \"https://git.kernel.org/stable/c/0b31e28fbd773aefb6164687e0767319b8199829\"}, {\"url\": \"https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4\"}, {\"url\": \"https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c\"}, {\"url\": \"https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c\"}, {\"url\": \"https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nima: Fix use-after-free on a dentry\u0027s dname.name\\n\\n-\u003ed_name.name can change on rename and the earlier value can be freed;\\nthere are conditions sufficient to stabilize it (-\u003ed_lock on dentry,\\n-\u003ed_lock on its parent, -\u003ei_rwsem exclusive on the parent\u0027s inode,\\nrename_lock), but none of those are met at any of the sites. Take a stable\\nsnapshot of the name instead.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.291\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.235\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.174\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.97\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-21T09:12:47.376Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39494\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-21T09:12:47.376Z\", \"dateReserved\": \"2024-06-25T14:23:23.748Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:20:30.348Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.