Vulnerability-Lookup

GHSA-9R43-P7WR-7396

Vulnerability from github – Published: 2024-12-29 12:30 – Updated: 2025-01-06 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

dlm: fix dlm_recover_members refcount on error

If dlm_recover_members() fails we don't drop the references of the previous created root_list that holds and keep all rsbs alive during the recovery. It might be not an unlikely event because ping_members() could run into an -EINTR if another recovery progress was triggered again.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-56749"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix dlm_recover_members refcount on error\n\nIf dlm_recover_members() fails we don\u0027t drop the references of the\nprevious created root_list that holds and keep all rsbs alive during the\nrecovery. It might be not an unlikely event because ping_members() could\nrun into an -EINTR if another recovery progress was triggered again.",
  "id": "GHSA-9r43-p7wr-7396",
  "modified": "2025-01-06T18:31:01Z",
  "published": "2024-12-29T12:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56749"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/200b977ebbc313a59174ba971006a231b3533dc5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fb2ec564887af1f365d754f7c306f1b5cd375b5e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-56749 (GCVE-0-2024-56749)

Vulnerability from cvelistv5 – Published: 2024-12-29 11:30 – Updated: 2026-08-05 11:46

Title

dlm: fix dlm_recover_members refcount on error

Summary

In the Linux kernel, the following vulnerability has been resolved: dlm: fix dlm_recover_members refcount on error If dlm_recover_members() fails we don't drop the references of the previous created root_list that holds and keep all rsbs alive during the recovery. It might be not an unlikely event because ping_members() could run into an -EINTR if another recovery progress was triggered again.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 19:57 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/3230718a75a6c30ed…
https://git.kernel.org/stable/c/fb2ec564887af1f36…
https://git.kernel.org/stable/c/200b977ebbc313a59…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3a747f4a2ee85d51b905e2df940de4a924f8060a , < 3230718a75a6c30ed60ac920c26be2119fa82b8e (git) Affected: 3a747f4a2ee85d51b905e2df940de4a924f8060a , < fb2ec564887af1f365d754f7c306f1b5cd375b5e (git) Affected: 3a747f4a2ee85d51b905e2df940de4a924f8060a , < 200b977ebbc313a59174ba971006a231b3533dc5 (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.11.11 , ≤ 6.11.* (semver) Unaffected: 6.12.2 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56749",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:57:31.663502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:03.795Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/recoverd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3230718a75a6c30ed60ac920c26be2119fa82b8e",
              "status": "affected",
              "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a",
              "versionType": "git"
            },
            {
              "lessThan": "fb2ec564887af1f365d754f7c306f1b5cd375b5e",
              "status": "affected",
              "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a",
              "versionType": "git"
            },
            {
              "lessThan": "200b977ebbc313a59174ba971006a231b3533dc5",
              "status": "affected",
              "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/recoverd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix dlm_recover_members refcount on error\n\nIf dlm_recover_members() fails we don\u0027t drop the references of the\nprevious created root_list that holds and keep all rsbs alive during the\nrecovery. It might be not an unlikely event because ping_members() could\nrun into an -EINTR if another recovery progress was triggered again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The failing condition is produced by data received over the DLM inter-node protocol (TCP/SCTP 21064) \u2014 `check_rcom_config()` returns -EPROTO based on `rf_lvblen`/`rf_lsflags`/`h_version` fields in a peer\u0027s DLM_RCOM_STATUS reply, and recovery itself is driven by remote membership events. No local access to the victim is needed.\nAC:L - A peer that answers the status ping with a mismatched config field deterministically forces `dlm_recover_members()` to return -EPROTO and hit the leaking `goto fail`; no race, no memory-layout grooming, and the leak recurs on every recovery cycle.\nPR:N - DLM lowcomms authenticates nothing by default \u2014 it only maps the source address to a configured nodeid, and the RCOM status reply is consumed before any credential check. A remote peer needs no privileges on the target lockspace to supply the malformed reply.\nUI:N - The recovery path runs autonomously in the dlm_recoverd kernel thread in response to cluster membership events and peer replies; no administrator or user action on the victim node is required.\nS:U - The leaked `dlm_rsb` references and the resulting memory pressure are confined to the kernel of the affected node; no security boundary such as a VM or IOMMU domain is crossed.\nC:N - The defect is a missed reference drop on an error path \u2014 no out-of-bounds read, no uninitialized data, and no kernel address is exposed to the attacker.\nI:N - Nothing is written out of bounds or through a stale pointer; the next `dlm_create_root_list()` rebuilds all list linkage, so no memory corruption or data modification results.\nA:H - Every active RSB is permanently pinned (refcount never reaches zero, so it is never deactivated, tossed, or freed), and each repeatable remote trigger pins the current RSB set, producing unbounded unreclaimable kernel slab growth on a busy GFS2/OCFS2 lockspace leading to memory exhaustion and node-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:21.358Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb2ec564887af1f365d754f7c306f1b5cd375b5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/200b977ebbc313a59174ba971006a231b3533dc5"
        }
      ],
      "title": "dlm: fix dlm_recover_members refcount on error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56749",
    "datePublished": "2024-12-29T11:30:15.127Z",
    "dateReserved": "2024-12-29T11:26:39.759Z",
    "dateUpdated": "2026-08-05T11:46:21.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-9R43-P7WR-7396

CVE-2024-56749 (GCVE-0-2024-56749)

Tags

Sightings

Nomenclature

Related by attack behaviour