CVE-2024-24855 - Vulnerability Details - OpenCVE

A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.5:rc1::::::

No data.

References

Link	Providers
https://bugzilla.openanolis.cn/show_bug.cgi?id=8149
https://nvd.nist.gov/vuln/detail/CVE-2024-24855
https://www.cve.org/CVERecord?id=CVE-2024-24855

History

Thu, 24 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Anolis

Published: 2024-02-05T07:25:41.568Z

Updated: 2025-04-24T15:55:53.555Z

Reserved: 2024-02-01T09:11:56.213Z

Link: CVE-2024-24855

Vulnrichment

Updated: 2024-08-01T23:28:12.898Z

NVD

Status : Modified

Published: 2024-02-05T08:15:44.353

Modified: 2024-11-21T08:59:51.400

Link: CVE-2024-24855

Redhat

Severity : Low

Publid Date: 2024-02-05T00:00:00Z

Links: CVE-2024-24855 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-24855", "assignerOrgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e", "state": "PUBLISHED", "assignerShortName": "Anolis", "dateReserved": "2024-02-01T09:11:56.213Z", "datePublished": "2024-02-05T07:25:41.568Z", "dateUpdated": "2025-04-24T15:55:53.555Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://kernel.org/", "defaultStatus": "unaffected", "modules": ["scsi"], "packageName": "kernel", "platforms": ["Linux", "x86", "ARM"], "product": "Linux kernel", "programFiles": ["https://gitee.com/anolis/cloud-kernel/blob/devel-5.10/drivers/scsi/lpfc/lpfc_hbadisc.c"], "repo": "https://gitee.com/anolis/cloud-kernel.git", "vendor": "Linux", "versions": [{"lessThan": "v6.5-rc2", "status": "affected", "version": "v2.6.34-rc2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "\u767d\u5bb6\u9a79 <baijiaju@buaa.edu.cn>"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "\u97e9\u6842\u680b <hanguidong@buaa.edu.cn>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.</p>\n<p></p>"}], "value": "A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.\n\n\n\n\n"}], "impacts": [{"capecId": "CAPEC-26", "descriptions": [{"lang": "en", "value": "CAPEC-26 Leveraging Race Conditions"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e", "shortName": "Anolis", "dateUpdated": "2024-02-05T07:25:41.568Z"}, "references": [{"url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8149"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/torvalds/linux/commit/0e881c0a4b614\">https://github.com/torvalds/linux/commit/0e881c0a4b614</a><br>"}], "value": " https://github.com/torvalds/linux/commit/0e881c0a4b614 https://github.com/torvalds/linux/commit/0e881c0a4b614 \n"}], "source": {"discovery": "UNKNOWN"}, "title": "Race condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-02-06T16:37:53.304176Z", "id": "CVE-2024-24855", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-24T15:55:53.555Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:12.898Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8149", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8149", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:12.898Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24855", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-06T16:37:53.304176Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:39.302Z"}}], "cna": {"title": "Race condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "\u767d\u5bb6\u9a79 <baijiaju@buaa.edu.cn>"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "\u97e9\u6842\u680b <hanguidong@buaa.edu.cn>"}], "impacts": [{"capecId": "CAPEC-26", "descriptions": [{"lang": "en", "value": "CAPEC-26 Leveraging Race Conditions"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitee.com/anolis/cloud-kernel.git", "vendor": "Linux", "modules": ["scsi"], "product": "Linux kernel", "versions": [{"status": "affected", "version": "v2.6.34-rc2", "lessThan": "v6.5-rc2", "versionType": "custom"}], "platforms": ["Linux", "x86", "ARM"], "packageName": "kernel", "programFiles": ["https://gitee.com/anolis/cloud-kernel/blob/devel-5.10/drivers/scsi/lpfc/lpfc_hbadisc.c"], "collectionURL": "https://kernel.org/", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": " https://github.com/torvalds/linux/commit/0e881c0a4b614 https://github.com/torvalds/linux/commit/0e881c0a4b614 \n", "supportingMedia": [{"type": "text/html", "value": "<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/torvalds/linux/commit/0e881c0a4b614\">https://github.com/torvalds/linux/commit/0e881c0a4b614</a><br>", "base64": false}]}], "references": [{"url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8149"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.</p>\n<p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e", "shortName": "Anolis", "dateUpdated": "2024-02-05T07:25:41.568Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24855", "state": "PUBLISHED", "dateUpdated": "2025-04-24T15:55:53.555Z", "dateReserved": "2024-02-01T09:11:56.213Z", "assignerOrgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e", "datePublished": "2024-02-05T07:25:41.568Z", "assignerShortName": "Anolis"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8187F7E-B31E-4C1C-8EB3-384193B7D7EE", "versionEndIncluding": "2.6.33.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "62E16EE6-6543-48AF-9A66-94DB66E3B8B6", "versionEndIncluding": "6.4.16", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc1:*:*:*:*:*:*", "matchCriteriaId": "2033D2AE-EB00-4696-B72F-8739021D1788", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*", "matchCriteriaId": "0B3E6E4D-E24E-4630-B00C-8C9901C597B0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.\n\n\n\n\n"}, {"lang": "es", "value": "Se encontr\u00f3 una condici\u00f3n de ejecuci\u00f3n en el controlador de dispositivo scsi del kernel de Linux en la funci\u00f3n lpfc_unregister_fcf_rescan(). Esto puede provocar un problema de desreferencia de puntero nulo, lo que posiblemente provoque un p\u00e1nico en el kernel o un problema de denegaci\u00f3n de servicio."}], "id": "CVE-2024-24855", "lastModified": "2024-11-21T08:59:51.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 4.2, "source": "security@openanolis.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-05T08:15:44.353", "references": [{"source": "security@openanolis.org", "tags": ["Permissions Required"], "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8149"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8149"}], "sourceIdentifier": "security@openanolis.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security@openanolis.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}