Bug 1227716 (CVE-2024-39494)

Summary:	VUL-0: CVE-2024-39494: kernel: ima: fix use-after-free on a dentry's dname.name
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	David Disseldorp <ddiss>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P2 - High	CC:	camila.matos, meissner, mkoutny
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/413809/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-39494:7.8:(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1227901

Description SMASH SMASH 2024-07-12 14:33:50 UTC

In the Linux kernel, the following vulnerability has been resolved:

ima: Fix use-after-free on a dentry's dname.name

->d_name.name can change on rename and the earlier value can be freed;
there are conditions sufficient to stabilize it (->d_lock on dentry,
->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,
rename_lock), but none of those are met at any of the sites. Take a stable
snapshot of the name instead.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39494
https://www.cve.org/CVERecord?id=CVE-2024-39494
https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4
https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c
https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de
https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c