{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56749", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T11:26:39.759Z", "datePublished": "2024-12-29T11:30:15.127Z", "dateUpdated": "2026-08-05T11:46:21.358Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:21.358Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix dlm_recover_members refcount on error\n\nIf dlm_recover_members() fails we don't drop the references of the\nprevious created root_list that holds and keep all rsbs alive during the\nrecovery. It might be not an unlikely event because ping_members() could\nrun into an -EINTR if another recovery progress was triggered again." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The failing condition is produced by data received over the DLM inter-node protocol (TCP/SCTP 21064) — `check_rcom_config()` returns -EPROTO based on `rf_lvblen`/`rf_lsflags`/`h_version` fields in a peer's DLM_RCOM_STATUS reply, and recovery itself is driven by remote membership events. No local access to the victim is needed.\nAC:L - A peer that answers the status ping with a mismatched config field deterministically forces `dlm_recover_members()` to return -EPROTO and hit the leaking `goto fail`; no race, no memory-layout grooming, and the leak recurs on every recovery cycle.\nPR:N - DLM lowcomms authenticates nothing by default — it only maps the source address to a configured nodeid, and the RCOM status reply is consumed before any credential check. A remote peer needs no privileges on the target lockspace to supply the malformed reply.\nUI:N - The recovery path runs autonomously in the dlm_recoverd kernel thread in response to cluster membership events and peer replies; no administrator or user action on the victim node is required.\nS:U - The leaked `dlm_rsb` references and the resulting memory pressure are confined to the kernel of the affected node; no security boundary such as a VM or IOMMU domain is crossed.\nC:N - The defect is a missed reference drop on an error path — no out-of-bounds read, no uninitialized data, and no kernel address is exposed to the attacker.\nI:N - Nothing is written out of bounds or through a stale pointer; the next `dlm_create_root_list()` rebuilds all list linkage, so no memory corruption or data modification results.\nA:H - Every active RSB is permanently pinned (refcount never reaches zero, so it is never deactivated, tossed, or freed), and each repeatable remote trigger pins the current RSB set, producing unbounded unreclaimable kernel slab growth on a busy GFS2/OCFS2 lockspace leading to memory exhaustion and node-wide denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/dlm/recoverd.c" ], "versions": [ { "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "3230718a75a6c30ed60ac920c26be2119fa82b8e", "status": "affected", "versionType": "git" }, { "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "fb2ec564887af1f365d754f7c306f1b5cd375b5e", "status": "affected", "versionType": "git" }, { "version": "3a747f4a2ee85d51b905e2df940de4a924f8060a", "lessThan": "200b977ebbc313a59174ba971006a231b3533dc5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/dlm/recoverd.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e" }, { "url": "https://git.kernel.org/stable/c/fb2ec564887af1f365d754f7c306f1b5cd375b5e" }, { "url": "https://git.kernel.org/stable/c/200b977ebbc313a59174ba971006a231b3533dc5" } ], "title": "dlm: fix dlm_recover_members refcount on error", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-56749", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:57:31.663502Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:03.795Z" } } ] } }