CVE-2024-40944 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix bug with call depth tracking The call to cc_platform_has() triggers a fault and system crash if call depth tracking is active because the GS segment has been reset by load_segments() and GS_BASE is now 0 but call depth tracking uses per-CPU variables to operate. Call cc_platform_has() earlier in the function when GS is still valid. [ bp: Massage. ]

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/2cfb464669b645a9b98478b74f2bcea9860dcff1
https://git.kernel.org/stable/c/93c1800b3799f17375989b0daf76497dd3e80922
https://git.kernel.org/stable/c/d91ddd05082691e69b30744825d18ae799293258
https://lore.kernel.org/linux-cve-announce/2024071219-CVE-2024-40944-98ef@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-40944
https://www.cve.org/CVERecord?id=CVE-2024-40944

History

Thu, 12 Sep 2024 08:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-12T12:25:18.490Z

Updated: 2025-05-04T09:18:30.668Z

Reserved: 2024-07-12T12:17:45.588Z

Link: CVE-2024-40944

Vulnrichment

Updated: 2024-08-02T04:39:55.992Z

NVD

Status : Awaiting Analysis

Published: 2024-07-12T13:15:16.753

Modified: 2024-11-21T09:31:55.347

Link: CVE-2024-40944

Redhat

Severity : Moderate

Publid Date: 2024-07-12T00:00:00Z

Links: CVE-2024-40944 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40944", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.588Z", "datePublished": "2024-07-12T12:25:18.490Z", "dateUpdated": "2025-05-04T09:18:30.668Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T09:18:30.668Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: Fix bug with call depth tracking\n\nThe call to cc_platform_has() triggers a fault and system crash if call depth\ntracking is active because the GS segment has been reset by load_segments() and\nGS_BASE is now 0 but call depth tracking uses per-CPU variables to operate.\n\nCall cc_platform_has() earlier in the function when GS is still valid.\n\n [ bp: Massage. ]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/machine_kexec_64.c"], "versions": [{"version": "5d8213864ade86b48fc492584ea86d65a62f892e", "lessThan": "d91ddd05082691e69b30744825d18ae799293258", "status": "affected", "versionType": "git"}, {"version": "5d8213864ade86b48fc492584ea86d65a62f892e", "lessThan": "2cfb464669b645a9b98478b74f2bcea9860dcff1", "status": "affected", "versionType": "git"}, {"version": "5d8213864ade86b48fc492584ea86d65a62f892e", "lessThan": "93c1800b3799f17375989b0daf76497dd3e80922", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/machine_kexec_64.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.35", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.6", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.9.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d91ddd05082691e69b30744825d18ae799293258"}, {"url": "https://git.kernel.org/stable/c/2cfb464669b645a9b98478b74f2bcea9860dcff1"}, {"url": "https://git.kernel.org/stable/c/93c1800b3799f17375989b0daf76497dd3e80922"}], "title": "x86/kexec: Fix bug with call depth tracking", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.992Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d91ddd05082691e69b30744825d18ae799293258", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2cfb464669b645a9b98478b74f2bcea9860dcff1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/93c1800b3799f17375989b0daf76497dd3e80922", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40944", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:04:17.603512Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:25.451Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d91ddd05082691e69b30744825d18ae799293258", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2cfb464669b645a9b98478b74f2bcea9860dcff1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/93c1800b3799f17375989b0daf76497dd3e80922", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.992Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40944", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:04:17.603512Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.548Z"}}], "cna": {"title": "x86/kexec: Fix bug with call depth tracking", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5d8213864ade", "lessThan": "d91ddd050826", "versionType": "git"}, {"status": "affected", "version": "5d8213864ade", "lessThan": "2cfb464669b6", "versionType": "git"}, {"status": "affected", "version": "5d8213864ade", "lessThan": "93c1800b3799", "versionType": "git"}], "programFiles": ["arch/x86/kernel/machine_kexec_64.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "custom"}, {"status": "unaffected", "version": "6.6.35", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.6", "versionType": "custom", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kernel/machine_kexec_64.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d91ddd05082691e69b30744825d18ae799293258"}, {"url": "https://git.kernel.org/stable/c/2cfb464669b645a9b98478b74f2bcea9860dcff1"}, {"url": "https://git.kernel.org/stable/c/93c1800b3799f17375989b0daf76497dd3e80922"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: Fix bug with call depth tracking\n\nThe call to cc_platform_has() triggers a fault and system crash if call depth\ntracking is active because the GS segment has been reset by load_segments() and\nGS_BASE is now 0 but call depth tracking uses per-CPU variables to operate.\n\nCall cc_platform_has() earlier in the function when GS is still valid.\n\n [ bp: Massage. ]"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:51:57.035Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40944", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:34:25.451Z", "dateReserved": "2024-07-12T12:17:45.588Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:25:18.490Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: x86/kexec: Fix bug with call depth tracking", "id": "2297528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297528"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nx86/kexec: Fix bug with call depth tracking\nThe call to cc_platform_has() triggers a fault and system crash if call depth\ntracking is active because the GS segment has been reset by load_segments() and\nGS_BASE is now 0 but call depth tracking uses per-CPU variables to operate.\nCall cc_platform_has() earlier in the function when GS is still valid.\n[ bp: Massage. ]", "A vulnerability was found in the Linux kernel's x86/kexec component, where the function call to cc_platform_has() could lead to a system crash when call depth tracking is active. This issue occurs because the GS segment is reset by load_segments(), setting GS_BASE to 0, while call depth tracking relies on per-CPU variables."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40944", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40944\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40944\nhttps://lore.kernel.org/linux-cve-announce/2024071219-CVE-2024-40944-98ef@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}