CVE-2024-41081

ila: block BH in ila_output()

Description

In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is called from lwtunnel_output() possibly from process context, and under rcu_read_lock(). We might be interrupted by a softirq, re-enter ila_output() and corrupt dst_cache data structures. Fix the race by using local_bh_disable().

N/A

CVSS

Severity:

EPSS 0.27%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/7435bd2f84a25aba607030237261b3795ba782da
https://git.kernel.org/stable/c/96103371091c6476eb07f4c66624bdd1b42f758a
https://git.kernel.org/stable/c/a0cafb7b0b94d18e4813ee4b712a056f280e7b5a
https://git.kernel.org/stable/c/feac2391e26b086f73be30e9b1ab215eada8d830
https://git.kernel.org/stable/c/b4eb25a3d70df925a9fa4e82d17a958a0a228f5f
https://git.kernel.org/stable/c/522c3336c2025818fa05e9daf0ac35711e55e316
https://git.kernel.org/stable/c/9f9c79d8e527d867e0875868b14fb76e6011e70c
https://git.kernel.org/stable/c/cf28ff8e4c02e1ffa850755288ac954b6ff0db8c

Frequently Asked Questions

What is the severity of CVE-2024-41081?: CVE-2024-41081 has not yet been assigned a CVSS score.
How to fix CVE-2024-41081?: To fix CVE-2024-41081, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-41081 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-41081 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-41081?: CVE-2024-41081 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.