CVE-2024-41020 filelock: Fix fcntl/close race recovery compat path
A race condition in the Linux kernel's file lock handling on 32-bit systems can lead to system instability or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41020?
CVE-2024-41020 is a high-severity vulnerability in Linux kernel, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
filelock: Fix fcntl/close race recovery compat path
When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport...
Apply exactly the same fix to the compat path for 32-bit kernels.
Weakness: CWE-362
Which versions are affected by CVE-2024-41020?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41020?
Apply the vendor's patch.
Is CVE-2024-41020 being exploited?
There is no known exploitation of CVE-2024-41020 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-41020, DEBIAN-CVE-2024-41020, GHSA-j29f-xrw6-fm6c, UBUNTU-CVE-2024-41020.