The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsUpgrade Rocky-Linux:8
kernel-rt-debug-devel
to version 0:4.18.0-553.8.1.rt7.349.el8_10 or higher.
This issue was patched in RLSA-2024:4352
.
Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug-devel
package and not the kernel-rt-debug-devel
package as distributed by Rocky-Linux
.
See How to fix?
for Rocky-Linux:8
relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry
do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later call pipelined_send.
This leads to a very hard to trigger race where a do_mq_timedreceive call might return and leave do_mq_timedsend to rely on an invalid address, causing the following crash:
RIP: 0010:wake_q_add_safe+0x13/0x60 Call Trace: __x64_sys_mq_timedsend+0x2a9/0x490 do_syscall_64+0x80/0x680 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f5928e40343
The race occurs as:
do_mq_timedreceive calls wq_sleep with the address of struct ext_wait_queue
on function stack (aliased as ewq_addr
here) - it
holds a valid struct ext_wait_queue *
as long as the stack has not
been overwritten.
ewq_addr
gets added to info->e_wait_q[RECV].list in wq_add, and
do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call
__pipelined_op.
Sender calls __pipelined_op::smp_store_release(&this->state,
STATE_READY). Here is where the race window begins. (this
is
ewq_addr
.)
If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it
will see state == STATE_READY
and break.
do_mq_timedreceive returns, and ewq_addr
is no longer guaranteed
to be a struct ext_wait_queue *
since it was on do_mq_timedreceive's
stack. (Although the address may not get overwritten until another
function happens to touch it, which means it can persist around for an
indefinite time.)
do_mq_timedsend::__pipelined_op() still believes ewq_addr
is a
struct ext_wait_queue *
, and uses it to find a task_struct to pass to
the wake_q_add_safe call. In the lucky case where nothing has
overwritten ewq_addr
yet, ewq_addr->task
is the right task_struct.
In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a
bogus address as the receiver's task_struct causing the crash.
do_mq_timedsend::__pipelined_op() should not dereference this
after
setting STATE_READY, as the receiver counterpart is now free to return.
Change __pipelined_op to call wake_q_add_safe on the receiver's
task_struct returned by get_task_struct, instead of dereferencing this
which sits on the receiver's stack.
As Manfred pointed out, the race potentially also exists in ipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix those in the same way.