netdev - Re: Is CVE-2024-26624 a valid issue?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 11 Mar 2024 10:47:14 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Ben Hutchings <ben@...adent.org.uk>
Cc: netdev <netdev@...r.kernel.org>, cve@...nel.org, 
	Salvatore Bonaccorso <carnil@...ian.org>
Subject: Re: Is CVE-2024-26624 a valid issue?

Hi Ben

Yes, my understanding of the issue is that it is a false positive.

Some kernels might crash whenever LOCKDEP triggers, as for any WARNing.

Thanks.

On Mon, Mar 11, 2024 at 1:02 AM Ben Hutchings <ben@...adent.org.uk> wrote:
>
> Hi Eric,
>
> I noted that CVE-2024-26624 was assigned by the kernel CVE authority to
> the issue fixed by commit 4d322dce82a1 "af_unix: fix lockdep positive
> in sk_diag_dump_icons()".  By my understanding, this does not fix any
> locking bug, but only a false positive report from lockdep.  Do you
> consider this a security issue?
>
> Ben.
>
> --
> Ben Hutchings
> Time is nature's way of making sure that
> everything doesn't happen at once.
>