Threats tagged 'ghsa-c77m-wh63-vhch'

CVE-2024-41012 is a vulnerability in the Linux kernel's file locking mechanism where a race condition between fcntl_setlk() and close() can lead to use-after-free reads when userspace accesses /proc/locks. This flaw allows reading arbitrary kernel memory but does not permit kernel memory corruption. The issue arises because certain lock removal calls can be denied by Linux Security Modules (LSMs), and allocation failures can prevent lock removal. The vulnerability has been fixed by changing the lock removal method to use locks_remove_posix(), which reliably removes POSIX locks.