Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2024-38582

5.3 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential hang in nilfs_detach_log_writer() Syzbot has reported a potential hang in nilfs_detach_log_writer() calle…

Published Jun 19, 2024CWE-667EPSS 0.86%

Overview

CVE-2024-38582 is a medium-severity vulnerability. It was published on June 19, 2024 and has a CVSS 3.1 base score of 5.3 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.3, rated MEDIUM. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential hang in nilfs_detach_log_writer()

Syzbot has reported a potential hang in nilfs_detach_log_writer() called

during nilfs2 unmount.

Analysis revealed that this is because nilfs_segctor_sync(), which

synchronizes with the log writer thread, can be called after

nilfs_segctor_destroy() terminates that thread, as shown in the call trace

below:

nilfs_detach_log_writer

nilfs_segctor_destroy

nilfs_segctor_kill_thread --> Shut down log writer thread

flush_work

nilfs_iput_work_func

nilfs_dispose_list

iput

nilfs_evict_inode

nilfs_transaction_commit

nilfs_construct_segment (if inode needs sync)

nilfs_segctor_sync --> Attempt to synchronize with

log writer thread

*** DEADLOCK ***

Fix this issue by changing nilfs_segctor_sync() so that the log w

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/06afce714d87c7cd1dcfccbcd800c5c5d2cf1cfdRefgit.kernel.org/stable/c/1c3844c5f4eac043954ebf6403fa9fd1f0e9c1c0Refgit.kernel.org/stable/c/6e5c8e8e024e147b834f56f2115aad241433679bRefgit.kernel.org/stable/c/911d38be151921a5d152bb55e81fd752384c6830Refgit.kernel.org/stable/c/a8799662fed1f8747edae87a1937549288baca6aRefgit.kernel.org/stable/c/bc9cee50a4a4ca23bdc49f75ea8242d8a2193b3bRefgit.kernel.org/stable/c/c516db6ab9eabbedbc430b4f93b0d8728e9b427fRefgit.kernel.org/stable/c/eb85dace897c5986bc2f36b3c783c6abb8a4292eRefgit.kernel.org/stable/c/eff7cdf890b02596b8d73e910bdbdd489175dbdbRefgit.kernel.org/stable/c/06afce714d87c7cd1dcfccbcd800c5c5d2cf1cfd

How CyberStrike helps

Frequently asked questions

What is CVE-2024-38582?

CVE-2024-38582 is a medium-severity vulnerability. It was published on June 19, 2024 and has a CVSS 3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2024-38582?

This vulnerability has a CVSS 3.1 base score of 5.3, rated MEDIUM. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-38582?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-38582?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-38582 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2024

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999