{"id":"CVE-2024-35954","state":"PUBLISHED","title":"scsi: sg: Avoid sg device teardown race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Avoid sg device teardown race\n\nsg_remove_sfp_usercontext() must not use sg_device_destroy() after calling\nscsi_device_put().\n\nsg_device_destroy() is accessing the parent scsi_device request_queue which\nwill already be set to NULL when the preceding call to scsi_device_put()\nremoved the last reference to the parent scsi_device.\n\nThe resulting NULL pointer exception will then crash the kernel.","publishedAt":"2024-05-20T09:41:47.944Z","updatedAt":"2026-08-05T11:31:11.820Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"db59133e927916d8a25ee1fd8264f2808040909d","status":"affected","lessThan":"46af9047523e2517712ae8e71d984286c626e022","versionType":"git"},{"version":"db59133e927916d8a25ee1fd8264f2808040909d","status":"affected","lessThan":"b0d1ebcc1a9560e494ea9b3ee808540db26c5086","versionType":"git"},{"version":"db59133e927916d8a25ee1fd8264f2808040909d","status":"affected","lessThan":"27f58c04a8f438078583041468ec60597841284d","versionType":"git"},{"version":"4cc664e59bf2553771e4c9e90f758f7434cfdc22","status":"affected","versionType":"git"},{"version":"6.4.7","status":"affected","lessThan":"6.5","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/sg.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.28","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.7","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/sg.c"]}],"references":["https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022","https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086","https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/35xxx/CVE-2024-35954.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-35954","state":"PUBLISHED","datePublished":"2024-05-20T09:41:47.944Z","dateUpdated":"2026-08-05T11:31:11.820Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-17T13:50:33.135Z"},"containers":{"cna":{"title":"scsi: sg: Avoid sg device teardown race","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Avoid sg device teardown race\n\nsg_remove_sfp_usercontext() must not use sg_device_destroy() after calling\nscsi_device_put().\n\nsg_device_destroy() is accessing the parent scsi_device request_queue which\nwill already be set to NULL when the preceding call to scsi_device_put()\nremoved the last reference to the parent scsi_device.\n\nThe resulting NULL pointer exception will then crash the kernel."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"db59133e927916d8a25ee1fd8264f2808040909d","status":"affected","lessThan":"46af9047523e2517712ae8e71d984286c626e022","versionType":"git"},{"version":"db59133e927916d8a25ee1fd8264f2808040909d","status":"affected","lessThan":"b0d1ebcc1a9560e494ea9b3ee808540db26c5086","versionType":"git"},{"version":"db59133e927916d8a25ee1fd8264f2808040909d","status":"affected","lessThan":"27f58c04a8f438078583041468ec60597841284d","versionType":"git"},{"version":"4cc664e59bf2553771e4c9e90f758f7434cfdc22","status":"affected","versionType":"git"},{"version":"6.4.7","status":"affected","lessThan":"6.5","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/sg.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.28","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.7","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/sg.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022"},{"url":"https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086"},{"url":"https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is entered by opening and closing the `/dev/sgN` character device, i.e. local file/syscall access to the SCSI generic driver. There is no network-facing consumer of `sg_remove_sfp_usercontext()`.\nAC:L - The attacker holds one side of the race directly (it owns the open sg fd and chooses when to `close()`), and can supply the other side by hot-unplugging its own removable SCSI/USB storage or by looping open/close across a hot-unplug; once sg holds the last `scsi_device` reference the ordering bug fires deterministically, and the attempt is freely repeatable.\nPR:L - No capability check exists on this path — only DAC permission on `/dev/sgN`, which is granted to the unprivileged `disk` group on mainstream distros and is world-accessible on many embedded/appliance and storage-software deployments; the device-removal side (physical unplug, transport loss, hypervisor hot-unplug) needs no privilege either.\nUI:N - The attacker performs the `open()`, triggers the device teardown, and performs the final `close()` from its own process; no victim action is required.\nS:U - The use-after-free and the resulting corruption are confined to kernel memory within the same security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - `sg_device_destroy()` dereferences the already-`kfree()`d `struct scsi_device`, and the reclaimed slab can be groomed so the stale `request_queue` pointer aims `blk_trace_remove()`/`blk_put_queue()` at attacker-chosen kernel memory, yielding a leverageable kernel-memory disclosure primitive.\nI:H - The stale pointer loaded from freed memory is used for writes — `mutex_lock(&q->debugfs_mutex)`, `rcu_replace_pointer(q->blk_trace, NULL)`, and `refcount_dec_and_test(&q->refs)` — so a reallocated slab gives a controlled write into kernel memory and a path to control-flow hijack.\nA:H - In the common case the stale value is NULL and `blk_trace_remove(NULL)`/`blk_put_queue(NULL)` immediately oops the kernel, as stated in the fix commit; the crash is repeatable and takes down the whole system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:31:11.820Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.28"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.8.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.7"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-35954","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-20T17:01:34.449905Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:34:37.893Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T03:21:49.126Z"}}]}}}