CVE-2024-39371

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: check for non-NULL file pointer in io_file_can_poll()

In earlier kernels, it was possible to trigger a NULL pointer

dereference off the forced async preparation path, if no file had

been assigned. The trace leading to that looks as follows:

BUG: kernel NULL pointer dereference, address: 00000000000000b0

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP

CPU: 67 PID: 1633 Comm: buf-ring-invali Not tainted 6.8.0-rc3+ #1

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 2/2/2022

RIP: 0010:io_buffer_select+0xc3/0x210

Code: 00 00 48 39 d1 0f 82 ae 00 00 00 48 81 4b 48 00 00 01 00 48 89 73 70 0f b7 50 0c 66 89 53 42 85 ed 0f 85 d2 00 00 00 48 8b 13 <48> 8b 92 b0 00 00 00 48 83 7a 40 00 0f 84 21 01 00 00 4c 8b 20 5b

RSP: 0018:ffffb7bec38c7d88 EFLAGS: 00010246

RAX: ffff97af2be61000 RBX: ffff97af234f1700 RCX: 0000000000000040

RDX: 0000000000000000 RSI: ffff97aecfb04820 RDI: ffff97af234f1700

RBP: 000000000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References