Resource Injection Affecting kernel-bootwrapper package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL7-KERNELBOOTWRAPPER-7427300
- published 6 Jul 2024
- disclosed 5 Jul 2024
Introduced: 5 Jul 2024
CVE-2024-39477 Open this link in a new tabHow to fix?
There is no fixed version for RHEL:7 kernel-bootwrapper.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-bootwrapper package and not the kernel-bootwrapper package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: do not call vma_add_reservation upon ENOMEM
sysbot reported a splat [1] on __unmap_hugepage_range(). This is because vma_needs_reservation() can return -ENOMEM if allocate_file_region_entries() fails to allocate the file_region struct for the reservation.
Check for that and do not call vma_add_reservation() if that is the case, otherwise region_abort() and region_del() will see that we do not have any file_regions.
If we detect that vma_needs_reservation() returned -ENOMEM, we clear the hugetlb_restore_reserve flag as if this reservation was still consumed, so free_huge_folio() will not increment the resv count.