In the Linux kernel, the following vulnerability has been resolved:
ovl: fix leaked dentry
Since commit 6815f479ca90 ("ovl: use only uppermetacopy state in ovl_lookup()"), overlayfs doesn't put temporary dentry when there is a metacopy error, which leads to dentry leaks when shutting down the related superblock:
overlayfs: refusing to follow metacopy origin for (/file0) ... BUG: Dentry (____ptrval____){i=3f33,n=file3} still in use (1) [unmount of overlay overlay] ... WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1 ... RIP: 0010:umount_check.cold+0x107/0x14d ... Call Trace: d_walk+0x28c/0x950 ? dentry_lru_isolate+0x2b0/0x2b0 ? __kasan_slab_free+0x12/0x20 do_one_tree+0x33/0x60 shrink_dcache_for_umount+0x78/0x1d0 generic_shutdown_super+0x70/0x440 kill_anon_super+0x3e/0x70 deactivate_locked_super+0xc4/0x160 deactivate_super+0xfa/0x140 cleanup_mnt+0x22e/0x370 __cleanup_mnt+0x1a/0x30 task_work_run+0x139/0x210 do_exit+0xb0c/0x2820 ? __kasan_check_read+0x1d/0x30 ? find_held_lock+0x35/0x160 ? lock_release+0x1b6/0x660 ? mm_update_next_owner+0xa20/0xa20 ? reacquire_held_locks+0x3f0/0x3f0 ? __sanitizer_cov_trace_const_cmp4+0x22/0x30 do_group_exit+0x135/0x380 __do_sys_exit_group.isra.0+0x20/0x20 __x64_sys_exit_group+0x3c/0x50 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xae ... VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds. Have a nice day...
This fix has been tested with a syzkaller reproducer.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade bpftoolUpgrade kernel-debug-modulesUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-coreUpgrade kernel-rt-kvmUpgrade perfUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-headersUpgrade kernel-rt-debug-kvmUpgrade kernel-docUpgrade kernel-zfcpdumpUpgrade kernelUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-devel | Jul 3, 2024 | Feb 27, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade python-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64 | May 28, 2024 | Feb 27, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Feb 27, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 3, 2024 | Feb 27, 2024 |
| Rocky_linux | — | Upgrade kernelUpgrade kernel-toolsUpgrade perfUpgrade python3-perfUpgrade kernel-rtUpgrade kernel-rt-kvmUpgrade kernel-cross-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-headersUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-debuginfoUpgrade kernel-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-debug-develUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-rt-debug | Jul 16, 2024 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub