Detections
Analytics

Google: sys-kernel/lakitu-kernel-6_1: security update to 18244.236.26

medium Tenable Cloud Security Plugin ID 451563

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: static_call: Handle module init
 failure correctly in static_call_del_module() Module insertion invokes static_call_add_module() to
 initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which
 allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated
 key into it so further modules can be added or to append the module to the module chain. If that
 allocation fails the function returns with an error code and the module core invokes
 static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when
 all keys used by the module were converted over to a module chain before the failure. If not then
 static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct
 static_call_mod. The problem is that key::mods is not a individual struct member of struct
 static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned
 long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the
 list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A
 mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly
 assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and
 dereferences the pointer to the list of built-in call sites, which is obviously bogus. Cure it by checking
 whether the key has a sites or a mods pointer. If it's a sites pointer then the key is not to be touched.
 As the sites are walked in the same order as in __static_call_init() the site walk can be terminated
 because all subsequent sites have not been touched by the init code due to the error exit. If it was
 converted before the allocation fail, then the inner loop which searches for a module match will find
 nothing. A fail in the second allocation in __static_call_init() is harmless and does not require special
 treatment. The first allocation succeeded and converted the key to a module chain. That first entry has
 mod::mod == NULL and mod::next == NULL, so the inner loop of static_call_del_module() will neither find a
 module match nor a module chain. The next site in the walk was either already converted, but can't match
 the module, or it will exit the outer loop because it has a static_call_site pointer and not a
 static_call_mod pointer. (CVE-2024-50002)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 18244.236.26 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-113.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 451563

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.09

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-50002

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/21/2024

Reference Information

CVE: CVE-2024-50002