linux-cve-announce - CVE-2024-35947: dyndbg: fix old BUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024051952-CVE-2024-35947-09bb@gregkh>
Date: Sun, 19 May 2024 13:14:53 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-35947: dyndbg: fix old BUG_ON in >control parser

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dyndbg: fix old BUG_ON in >control parser

Fix a BUG_ON from 2009.  Even if it looks "unreachable" (I didn't
really look), lets make sure by removing it, doing pr_err and return
-EINVAL instead.

The Linux kernel CVE team has assigned CVE-2024-35947 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.314 with commit 3c718bddddca
	Fixed in 5.4.276 with commit 343081c21e56
	Fixed in 5.10.217 with commit 41d8ac238ab1
	Fixed in 5.15.159 with commit ba3c118cff7b
	Fixed in 6.1.91 with commit a66c869b17c4
	Fixed in 6.6.31 with commit a69e1bdd777c
	Fixed in 6.8.10 with commit 529e18527855
	Fixed in 6.9 with commit 00e7d3bea2ce

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-35947
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	lib/dynamic_debug.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3c718bddddca9cbef177ac475b94c5c91147fb38
	https://git.kernel.org/stable/c/343081c21e56bd6690d342e2f5ae8c00183bf081
	https://git.kernel.org/stable/c/41d8ac238ab1cab01a8c71798d61903304f4e79b
	https://git.kernel.org/stable/c/ba3c118cff7bcb0fe6aa84ae1f9080d50e31c561
	https://git.kernel.org/stable/c/a66c869b17c4c4dcf81d273b02cb0efe88e127ab
	https://git.kernel.org/stable/c/a69e1bdd777ce51061111dc419801e8a2fd241cc
	https://git.kernel.org/stable/c/529e1852785599160415e964ca322ee7add7aef0
	https://git.kernel.org/stable/c/00e7d3bea2ce7dac7bee1cf501fb071fd0ea8f6c