CHK NVD : CVE-2024-38545 - dafad245

[witchcraze]

[CVE Configuration Update Request] Update Suggestion - CVE-2024-38545 - Cvss3 : 7.8

https://www.linuxkernelcves.com/cves/CVE-2024-38545
https://gitlab.com/cip-project/cip-kernel/cip-kernel-sec/-/blob/master/issues/CVE-2024-38545.yml
https://github.com/witchcraze/NVD_CHECK/blob/main/kernel/CVE-2024-38545.json

- CVE-2024-38545
- Suggested Configuration
  - OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.0 up to (excluding) 5.15.168
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.0 up to (excluding) 6.1.93
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.10.0 up to (excluding) 6.10
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.0 up to (excluding) 6.6.33
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.8.0 up to (excluding) 6.8.12
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.9.0 up to (excluding) 6.9.3
- Reference
  - https://www.kernel.org/pub//linux/kernel/v5.x/ChangeLog-5.15.168
  - https://www.kernel.org/pub//linux/kernel/v6.x/ChangeLog-6.1.93
  - https://www.kernel.org/pub//linux/kernel/v6.x/ChangeLog-6.10
  - https://www.kernel.org/pub//linux/kernel/v6.x/ChangeLog-6.6.33
  - https://www.kernel.org/pub//linux/kernel/v6.x/ChangeLog-6.8.12
  - https://www.kernel.org/pub//linux/kernel/v6.x/ChangeLog-6.9.3
- Reference (Commit)
  - RDMA/hns: Fix UAF for cq async event
    - Fixed by
      - 5.15.168 (330c825e66ef65278e4ebe57fd49c1d6f3f4e34e)
      - 6.1.93 (763780ef0336a973e933e40e919339381732dcaf)
      - 6.10 (a942ec2745ca864cd8512142100e4027dc306a42) (upstream)
      - 6.6.33 (63da190eeb5c9d849b71f457b15b308c94cbaf08)
      - 6.8.12 (39d26cf46306bdc7ae809ecfdbfeff5aa1098911)
      - 6.9.3 (37a7559dc1358a8d300437e99ed8ecdab0671507)
    - Will be introduced by
      - https://github.com/torvalds/linux/commit/9a4435375cd1
- I Checked
  - XXXXXXXXXXXXXXXXXXXXXXXXXXXX is written as upstream commit in each ChangeLog
  - From XXXXXXXX commit page, XXXXXXXXXXX is the most oldest in commit-branches area
  - For 3.16.35, there is related post at lkml
  - For 3.16 series, 3.16.35 is the next release from 3.16.7 which was released at 2014
  - https://mirrors.edge.kernel.org/pub/linux/kernel/v3.x/
  - XXXX

https://nvd.nist.gov/vuln/detail/CVE-2024-38545

URI	Start(Ex)	Start(Inc)	End(Ex)	End(Inc)
cpe:/o:linux:linux_kernel		4.9	6.1.93
cpe:/o:linux:linux_kernel		6.2	6.6.33
cpe:/o:linux:linux_kernel		6.7	6.8.12
cpe:/o:linux:linux_kernel		6.9	6.9.3